CVE-2021-24992 – Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2021-24992

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. El plugin Smart Floating / Sticky Buttons de WordPress versiones anteriores a 2.5.5, no sanea y escapa de algunos parámetros antes de mostrarlos en los atributos y en la página, lo que podría permitir a usuarios con altos privilegios llevar a cabo ataques de tipo Cross-Site Scripting incluso cuando la capacidad unfiltered_html está deshabilitada • https://wpscan.com/vulnerability/db0b9480-2ff4-423c-a745-68e983ffa12b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •