Read the docs
TI-2023-02217 Aliases CVE-2023-2362GHSA-vx6w-q89v-7755

Multiple Plugins from Wow-Company - Reflected XSS

Priority MEDIUM 60Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Float menu (Unknown): 5.0.2Bubble Menu (Unknown): 3.0.4+10 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFloat menubefore 5.0.25.0.2Patch availableCNA
UnknownBubble Menubefore 3.0.43.0.4Patch availableCNA
UnknownButton Generatorbefore 2.3.52.3.5Patch availableCNA
UnknownCalculator Builderbefore 1.5.11.5.1Patch availableCNA
UnknownCounter Boxbefore 1.2.21.2.2Patch availableCNA
UnknownFloating Buttonbefore 5.3.15.3.1Patch availableCNA
UnknownHerd Effectsbefore 5.2.25.2.2Patch availableCNA
UnknownPopup Boxbefore 2.2.22.2.2Patch availableCNA
UnknownSide Menu Litebefore 4.0.24.0.2Patch availableCNA
UnknownSticky Buttonsbefore 3.1.13.1.1Patch availableCNA
UnknownWow Skype Buttonsbefore 4.0.24.0.2Patch availableCNA
UnknownWP Coderbefore 2.5.62.5.6Patch availableCNA
  • Float menu VendorUnknown Affected before 5.0.2 Fixed in 5.0.2 Patch available CNA
  • Bubble Menu VendorUnknown Affected before 3.0.4 Fixed in 3.0.4 Patch available CNA
  • Button Generator VendorUnknown Affected before 2.3.5 Fixed in 2.3.5 Patch available CNA
  • Calculator Builder VendorUnknown Affected before 1.5.1 Fixed in 1.5.1 Patch available CNA
  • Counter Box VendorUnknown Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
  • Floating Button VendorUnknown Affected before 5.3.1 Fixed in 5.3.1 Patch available CNA
  • Herd Effects VendorUnknown Affected before 5.2.2 Fixed in 5.2.2 Patch available CNA
  • Popup Box VendorUnknown Affected before 2.2.2 Fixed in 2.2.2 Patch available CNA
  • Side Menu Lite VendorUnknown Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
  • Sticky Buttons VendorUnknown Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
  • Wow Skype Buttons VendorUnknown Affected before 4.0.2 Fixed in 4.0.2 Patch available CNA
  • WP Coder VendorUnknown Affected before 2.5.6 Fixed in 2.5.6 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:wow-company:bubble_menu:*:*:*:*:free:wordpress:*:*before 3.0.4VulnerableWow-Company
cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:*before 2.3.5VulnerableWow-Company
cpe:2.3:a:wow-company:calculator-builder:*:*:*:*:*:wordpress:*:*before 1.5.1VulnerableWow-Company
cpe:2.3:a:wow-company:counter_box:*:*:*:*:*:wordpress:*:*before 1.2.2VulnerableWow-Company
cpe:2.3:a:wow-company:float_menu:*:*:*:*:*:wordpress:*:*before 5.0.2VulnerableWow-Company
cpe:2.3:a:wow-company:floating_button:*:*:*:*:*:wordpress:*:*before 5.3.1VulnerableWow-Company
cpe:2.3:a:wow-company:herd_effects:*:*:*:*:*:wordpress:*:*before 5.2.2VulnerableWow-Company
cpe:2.3:a:wow-company:popup_box:*:*:*:*:*:wordpress:*:*before 2.2.2VulnerableWow-Company
cpe:2.3:a:wow-company:side_menu_lite:*:*:*:*:*:wordpress:*:*before 4.0.2VulnerableWow-Company
cpe:2.3:a:wow-company:sticky_buttons:*:*:*:*:*:wordpress:*:*before 3.1.1VulnerableWow-Company
  • cpe:2.3:a:wow-company:bubble_menu:*:*:*:*:free:wordpress:*:* Versions before 3.0.4 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:button_generator:*:*:*:*:*:wordpress:*:* Versions before 2.3.5 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:calculator-builder:*:*:*:*:*:wordpress:*:* Versions before 1.5.1 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:counter_box:*:*:*:*:*:wordpress:*:* Versions before 1.2.2 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:float_menu:*:*:*:*:*:wordpress:*:* Versions before 5.0.2 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:floating_button:*:*:*:*:*:wordpress:*:* Versions before 5.3.1 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:herd_effects:*:*:*:*:*:wordpress:*:* Versions before 5.2.2 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:popup_box:*:*:*:*:*:wordpress:*:* Versions before 2.2.2 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:side_menu_lite:*:*:*:*:*:wordpress:*:* Versions before 4.0.2 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:sticky_buttons:*:*:*:*:*:wordpress:*:* Versions before 3.1.1 Vulnerable ·Wow-Company
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wow-company:wow_skype_buttons:*:*:*:*:*:wordpress:*:*before 4.0.2VulnerableWow-Company
cpe:2.3:a:wow-company:wp_coder:*:*:*:*:*:wordpress:*:*before 2.5.6VulnerableWow-Company
  • cpe:2.3:a:wow-company:wow_skype_buttons:*:*:*:*:*:wordpress:*:* Versions before 4.0.2 Vulnerable ·Wow-Company
  • cpe:2.3:a:wow-company:wp_coder:*:*:*:*:*:wordpress:*:* Versions before 2.5.6 Vulnerable ·Wow-Company

Remediation

  • Fix · CNA Float menu (Unknown) Fixed in 5.0.2
  • Fix · CNA Bubble Menu (Unknown) Fixed in 3.0.4
  • Fix · CNA Button Generator (Unknown) Fixed in 2.3.5
  • Fix · CNA Calculator Builder (Unknown) Fixed in 1.5.1
  • Fix · CNA Counter Box (Unknown) Fixed in 1.2.2
  • Fix · CNA Floating Button (Unknown) Fixed in 5.3.1
  • Fix · CNA Herd Effects (Unknown) Fixed in 5.2.2
  • Fix · CNA Popup Box (Unknown) Fixed in 2.2.2
  • Fix · CNA Side Menu Lite (Unknown) Fixed in 4.0.2
  • Fix · CNA Sticky Buttons (Unknown) Fixed in 3.1.1
  • Fix · CNA Wow Skype Buttons (Unknown) Fixed in 4.0.2
  • Fix · CNA WP Coder (Unknown) Fixed in 2.5.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2362
  2. 2026-10-03 Alias added: GHSA-vx6w-q89v-7755

References

Exploit 1

  • TI-2023-03407 Bubble Menu < 3.0.5 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2023-09771 WordPress Bubble Menu – circle floating menu Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences