27 WordPress plugin flaws: CVE-2026-15383 hits a Japan-made plugin

On August 3, 2026, 27 vulnerabilities across 22 WordPress plugins were disclosed at once. All of them received CVE identifiers from WPScan, the WordPress-focused security research team, and they were published as a batch to the US government vulnerability database NVD at around 15:00 JST the same day.

One entry in that batch is a plugin built by a Japanese company and running on roughly 9,000 sites: Blog Floating Button, which places a button that follows the reader in the corner of a blog. It is developed by Meril Inc. of Shizuoka City, and most of its users are likely Japanese-language bloggers.

This one differs from the other 26 in an important way. The fixed version shipped on July 31, yet neither the vendor's own site nor the vulnerability databases say so. The vendor site still advertises "Latest version: 1.4.15," and the WPScan entry still reads "No known fix." The bug is patched, but users have almost no way to find that out.

Who can actually exploit these 27 issues

A batch disclosure draws attention to the raw count, but what determines whether your site is at risk is what the attacker needs in order to pull it off. An issue that requires no login at all and one that requires an insider who can already write posts sit at completely different levels of concern. The table below splits the 27 by that condition.

The top two rows, 14 issues in total, are the ones to watch. 11 of them work with no login at all, and those get targeted regardless of how well known your site is. Attackers are not picking specific companies; they feed the published list straight into scanners and mechanically harvest matching sites worldwide.

The 13 issues in the bottom four rows, by contrast, do not call for alarm. A personal blog with no outside writers, or a company site that accepts no registrations, has no entry point in the first place. You should still update, but this is not a reason to rush to the server tonight.

One caveat on severity scores (CVSS). All 27 are in "awaiting analysis" status at NVD, and as of August 3 there is no US government score for any of them. Wherever this article cites a score, it is WPScan's own value, and we say so. NVD's assessment may follow later and the numbers may move.

What actually happens in the Japanese-made Blog Floating Button

Blog Floating Button (BFB) is a plugin for placing a button at the bottom or side of a blog that follows the reader as they scroll. It lets you add calls to action like "Contact us" or "Subscribe to the newsletter" without writing HTML. It also counts how many times each button is clicked, and that counter is where this problem lives.

According to the WordPress plugin directory, the plugin is active on about 9,000 sites, with roughly 80,000 cumulative downloads. The vendor's official site and all of its documentation are in Japanese, making clear it was built for Japanese bloggers. The author is Daisuke Nakajima, known for his writing on running a blog.

The browser name a visitor claims was printed straight into the admin screen

When someone visits a site, the browser sends the server a self-description such as "I am Safari on iPhone." That string is called the User-Agent. The visitor can set it to whatever they like. The browser fills it in automatically; the server does not verify or issue it.

When BFB recorded a button click, it stored that self-description in the database as-is and listed it in the admin "access analytics report." CVE-2026-15383 is the fact that neither the storing nor the displaying step inspected the contents.

The consequence: instead of a browser name, an attacker writes a small script into that field and visits the target site once. Then they wait. The moment the site owner opens the report in the admin area, that script runs inside the browser of a logged-in administrator. Create a new administrator account, rewrite posts, exfiltrate data. It all counts as though the administrator did it, so nothing stops it.

This class of attack is called stored cross-site scripting (stored XSS). The injected script stays on the server and fires later when an administrator opens the page, which means the attacker does not even need to know when that will happen. It was reported by Indian security researcher Shivamani Vastrala, and WPScan rates the severity score at 8.8 out of 10.

The fix shipped July 31 — but there is no way to learn that

This is the part worth stressing. The problem is already fixed. The WordPress plugin directory shows BFB released version 1.4.21 on July 31, 2026, and its changelog states plainly: "Security release." WPScan published its advisory on July 24, so the vendor shipped a fix within a week. That is on the fast side.

And yet users cannot reach that fact. Three things compound.

The WPScan page is stamped "Last Updated 2026-07-31," so something was updated the very day the fix shipped, yet the "no known fix" line never changed. Vulnerability sites worldwide cite this database, so until that one line is corrected, downstream sources will keep saying "unpatched."

Because following the published information alone is not enough to judge, we downloaded 1.4.20 and 1.4.21 and diffed them. Here is what we found. In the code that receives the visitor's self-description (tracking.php and others), validation was added where the incoming string had previously been used as-is. In the report display (report-detail-access.php), lines that piped database values straight into HTML were rewritten to escape them first. The reported issue and the actual changes line up. The fix is real.

For accuracy, one addition: the endpoint that accepts the tracking records still requires no login in 1.4.21. It exists to count visitor clicks, so the design keeps it open and instead fixes how the received string is handled. Do not read this as "the endpoint was closed."

A hole with no CVE number was closed in the same update

The 1.4.21 changelog lists fixes beyond the XSS published as CVE-2026-15383. The original text mentions a fix for SQL injection via the search and filter input fields on the report screen, a fix for a problem where error output leaked server-side storage paths, and a plugin-wide review of output and input handling.

Diffing the code backed this up as well. In 1.4.20 there were five places where search conditions were concatenated as raw strings and sent to the database; in 1.4.21 all five were rewritten to bind the values safely.

That SQL injection has no CVE number assigned. Tooling that reads vulnerability databases mechanically therefore cannot see that the problem existed at all. If you track only the one issue that got a number, you miss what was fixed alongside it in the same release. We covered a similar pattern in our roundup of OSS supply chain scanning tools: fixes without numbers always fall through systems that only count numbers.

If you use BFB, there is exactly one thing to do. Open the Plugins list in your admin area and update Blog Floating Button to 1.4.21. The update notice in the WordPress admin is more accurate than the vendor's own site.

If you run a membership site, Simple Membership comes first

Of the 27, the heaviest in terms of potential damage are the two in Simple Membership. It is a plugin for building members-only pages and paid content, and it runs on about 40,000 sites.

CVE-2026-15930 is a flaw in the registration flow. During signup, the return value from a failed account creation was treated as a member ID without being checked, so registering with the same username as an existing administrator lets you overwrite that administrator's email address. Request a password reset afterward and the reset mail lands in the attacker's inbox. The result is a full takeover of the site's administrator, with no login required. It was reported by Brandon Steed; WPScan's severity score is 9.4, the highest among the 27.

Disclosed at the same time, CVE-2026-15931 is a stored XSS of the same shape as the BFB issue: the subscriber name contained in PayPal recurring-payment notifications is rendered as-is in the admin area (WPScan score 8.8, reported by Yaswanth Reddy Sunkara). Both were fixed in 4.7.8, and the latest release at publication is 4.7.9. Membership sites hold member names, email addresses and payment records, so a takeover costs more. If this applies to you, start here.

The 11 issues exploitable without logging in

Here are the 11 anyone can attempt, ordered by impact. Install counts are the figures published in the WordPress plugin directory.

What stands out in this table is that ChamaWP has only "10+" installs. That is the smallest bracket the WordPress directory uses, meaning a dozen or so sites worldwide actually run it. An article that only lists CVE numbers could write "two critical flaws let anyone reset any password," but this is the real scale of exposure. CVE-2026-16300 and CVE-2025-15672 are both fixed in 1.0.13, which is also the latest release at publication. We do not pad the count to stoke anxiety.

Link Library's CVE-2026-16532 affects a plugin for building link directories: the submission form where visitors can post links allows malicious commands to be sent to the database. About 10,000 sites are affected, and it is fixed in 7.9.3 (current release 7.9.4). If you expose the submission form publicly, raise the priority.

Seven issues with no fix — six of them were pulled from the directory just weeks ago

Of the 27, seven have no fixed version. Pressing update will not help, so the only response is removal. The same pattern appeared in the 27 issues published the day before, on August 2, where the oldest plugin had been removed from the directory back in 2018.

This time the circumstances differ. Checking the closure dates, all six were closed within the past two to six weeks. Rather than being abandoned and forgotten, they were most plausibly pulled because of these very reports.

All six carry the note "This closure is temporary, pending a full review." They may come back once the review completes, but until they do, sites still running them will receive no update notifications. Distribution is halted, so there is nothing to update from.

The remaining one, Super Store Finder, is a different case. It is a commercial store-locator product that was never distributed through the WordPress directory. CVE-2026-12965 affects 7.8 and below, and as of August 3 we could not confirm any fixed version. Users will have to wait for word from the seller.

Two plugins we said "just update" about yesterday have a sequel

We covered 27 issues in our August 2 article. Two of those plugins appear again a day later under different CVEs. And the version you need to be on has moved above the number we published yesterday.

If you followed yesterday's advice and moved to 1.6.12.6, you are still affected by what was published today. Simply Schedule Appointments, a booking plugin, is used by clinics, salons and professional practices for consultation scheduling, with about 60,000 installs. Today's CVE-2026-15254 lets someone who can write posts embed an admin-only shortcode in a post and pull out information about people who booked appointments. Yesterday's issue needed no login; this one requires a role. The urgency is lower, but going all the way to 1.6.12.13 is the safe move.

ProfileGrid, which builds member groups, follows the same shape. CVE-2026-16289 lets anyone with a mere subscriber account view the list of people who requested to join a private group. Fixed in 6.0.0.0; current release is 6.0.0.1.

Multiple reports against the same plugin in a short window are not unusual. The practical lesson is not to assume "I updated yesterday, so I'm fine".

Full list of the 27

All entries, including those not discussed above. The 11 rows with "None" in the "Role required" column are the ones that work without logging in.

Among the 27, the largest install base belongs to SVG Support at about 1 million sites. It is a plugin for loading diagrams and icons in SVG format, and CVE-2026-13340 is the fact that compressed SVGs (the .svgz extension) were excluded from sanitization. Exploiting it requires Author-level access or higher, and it is fixed in 2.5.17, with 2.6.1 current. The install count is not cause for alarm.

The two issues in Dokan, which runs multi-vendor online stores, come down to privilege boundaries not being enforced between shop operators. A vendor can bulk-change another shop's order statuses or rewrite another shop's product data. Fixed in 5.0.9, with 5.0.11 current. Because multiple businesses trade in the same installation, a broken boundary is not just the affected parties' problem.

As for the two that require administrator access (CVE-2026-16297 and CVE-2025-15673), frankly, the real-world impact is hard to picture. An administrator can already do anything on the site, so being able to "do something more" carries little weight. This matters only in narrow scenarios such as insider abuse where administrator accounts are handed to several co-operators.

Non-WordPress vulnerabilities published the same day

Four non-WordPress entries were also registered on August 3. They do not warrant separate articles, but one carries a name many readers will recognize, so it is worth a mention.

A flaw in Synology's setup utility — the NAS itself is unaffected

Taiwan's Synology, known for the network-attached storage (NAS) devices used in homes and small businesses, published Synology-SA-26:12 covering CVE-2026-4793. The severity score is 7.3.

The affected component is Synology Assistant, a Windows helper application typically used exactly once, when you buy a NAS, to discover the device and run initial setup. Its installer sets loose file permissions, so another user of the same PC can read and write files they should not be able to touch.

This is not a case of a NAS being taken over across the internet. An attacker needs the ability to log into that PC, and the timing of the installation matters too. Unless the machine is shared, those conditions are hard to meet. Fixed in 7.0.7-50095. The NAS operating system (DSM) is not involved.

One addition: the researcher who found and reported this is Kazuma Matsumoto of GMO Cybersecurity by Ierae. A Japanese researcher's name appears in Synology's official advisory. Among the CVE records published today, Japan is involved in Blog Floating Button and this one.

Three print server issues with essentially no Japanese user base

The remaining three (CVE-2026-18587, 18588 and 18589) concern the Wavlink WL-NU516U1 USB print server. Two carry a high severity score of 9.8, but we are not covering them in detail here, for the following reasons.

The model is a small device for sharing a printer on a home LAN and is not intended to be exposed directly to the internet. It ships with a Japanese manual and can be bought online, but corporate deployment in Japan is hard to imagine, and we judged that few readers would recognize the name as relevant to them. On top of that, the download location for the published fixed firmware currently returns an error and the file cannot be obtained. There is no remediation we could point readers to. We will revisit this if anything changes.

We also checked the US government catalog of vulnerabilities confirmed as exploited in the wild (KEV): none of the 31 entries registered that day appear in it. KEV coverage can be tracked on our CISA KEV dashboard (Japanese).

Checking whether your site is affected

Here is what a WordPress user should actually do, in order.

Also, take a backup before updating. Some of these involve a major version jump (ProfileGrid 5.x to 6.x, Contest Gallery 30.x to 31.x), and appearance or settings may change. Rushing an update and breaking your layout costs more time than it saves.

If you want to check whether you have already been compromised, the quickest first step is to look for unfamiliar names added to the list of administrator accounts. The takeover-capable issues here (Simple Membership, Import and export users and customers) work by creating a new administrator or rewriting an existing administrator's email address, so traces remain in the role and email columns of the Users list. Updating closes the hole, but if someone got in before you updated, any account they created stays behind.

Summary

The WordPress plugin vulnerabilities published on August 3, 2026 number 27, across 22 plugins. Of those, 20 are fixed by updating and 7 have no fixed version. Six of the seven without fixes were removed from the WordPress plugin directory only within the past two to six weeks.

The priorities, plainly. If you run a membership site on Simple Membership, go to 4.7.9 now. It is an administrator takeover that needs no login, and the single heaviest issue in this batch. Next, if you expose a public link submission form, move Link Library to 7.9.4.

And for Japanese bloggers, the practical action here is updating Blog Floating Button to 1.4.21. For this one, the sources saying "not yet fixed" are the ones that are wrong: the fix shipped on July 31. The vendor's site is frozen on outdated information and the vulnerability database has not changed its "no known fix" line, so users still cannot reach the correct answer. From our own diff of the code, the fix matches the reported issue and is genuine.

One more takeaway. Tracking only issues that received a CVE number leaves gaps. BFB 1.4.21 fixed a SQL injection with no number alongside the numbered XSS. Systems that only count numbers cannot find fixes that have none. Reading the changelog, unglamorous as it is, remains the most reliable method.

Finally, none of the 27 have any reports of exploitation in the wild, and none appear in KEV. Even so, a published list becomes an attacker's scan list as-is. The batch published the previous day, August 2, is covered in a separate article, which also includes six plugins removed from the directory. We have a separate writeup on WordPress core updates as well, so take a look at both.

Sources

• ▸WPScan - Blog Floating Button <= 1.4.20 Unauthenticated Stored XSS (confirmed the "No known fix" label)
• ▸CVE record - CVE-2026-15383 (Blog Floating Button)
• ▸WordPress.org - Blog Floating Button (1.4.21 / updated July 31, 2026 / about 9,000 sites)
• ▸Blog Floating Button - readme.txt (original 1.4.21 changelog)
• ▸Blog Floating Button official site (showing "Latest version: 1.4.15")
• ▸CVE record - CVE-2026-15930 (Simple Membership administrator takeover)
• ▸CVE record - CVE-2026-15931 (Simple Membership stored XSS)
• ▸WPScan - Simple Membership < 4.7.8 vulnerability details
• ▸CVE record - CVE-2026-16532 (Link Library)
• ▸CVE record - CVE-2026-15254 (Simply Schedule Appointments)
• ▸CVE record - CVE-2026-16289 (ProfileGrid)
• ▸CVE record - CVE-2026-13340 (SVG Support)
• ▸CVE record - CVE-2026-16564 (Dokan)
• ▸CVE record - CVE-2026-16250 (Personal QR Message, no fixed version)
• ▸WordPress.org - Personal QR Message (closed July 21, 2026)
• ▸WordPress.org - LogMyTrip (closed July 23, 2026)
• ▸WordPress.org - SoftMarket (closed July 6, 2026)
• ▸Synology-SA-26:12 (CVE-2026-4793 / researcher credit)
• ▸NVD - CVE-2026-18588 Detail (Wavlink WL-NU516U1)
• ▸CISA - Known Exploited Vulnerabilities Catalog (July 29, 2026 edition / 1,656 entries cross-checked)