CVE-2026-28170 in the Blog Floating Button plugin (versions <= 1.4.20) is an unauthenticated stored XSS that warrants significantly more urgency than its EPSS score of 0.0018 suggests. The vulnerability lives in a floating button component that renders on every page of a site by design — not on an admin panel or user-specific dashboard where exposure is contained. This architectural reality transforms the bug from a targeted attack requiring victim manipulation into an automatic infection vector that executes for every visitor the moment they load any page. The CVSS 7.1 reflects individual impact but completely misses the supply-chain dynamics: one compromised plugin creates a persistent injection point across every domain running it, with the attacker gaining access to every visitor's session simultaneously.
The 'unauthenticated' qualifier means the injection point itself is publicly accessible — no credentials or social engineering required. This makes the vulnerability trivially scriptable for mass exploitation through automated scanning of the entire WordPress plugin ecosystem. What should concern you is the compounding temporal gap: WordPress plugin ecosystems are notorious for delayed updates, and publicly known unauthenticated stored XSS in universal-rendering components creates an exploitation window that threat actors can operationalize within hours of disclosure — regardless of low EPSS rankings that measure targeted intent rather than opportunistic automation.
Your priority: identify whether Blog Floating Button or any plugin containing universal-rendering components (floating buttons, notification bars, popup builders) runs on your WordPress instances, verify the exact version, and patch immediately. If the plugin is abandoned (check WordPress.org for no recent updates), remove it entirely rather than hoping it gets patched. The historical pattern is clear — these components consistently generate stored XSS precisely because developers treat them as 'dumb UI' rather than attack surface, and the same code smell surfaces across thousands of plugin authors who never read each other's patch notes. The low EPSS score measures probability of targeted exploitation against your specific site; it does not account for automated exploitation that hits the entire plugin ecosystem simultaneously.