CVE-2024-6405: 
WordPress vulnerability analysis and mitigation

The Floating Social Buttons plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2024-6405, affecting all versions up to and including 1.5. The vulnerability was discovered and disclosed on June 28, 2024 (Wordfence Advisory).

The vulnerability stems from missing or incorrect nonce validation in the floating_social_buttons_option() function. The CVSS v3.1 base score is rated as 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability requiring user interaction (NVD Database).

If exploited, the vulnerability allows unauthenticated attackers to update the plugin's settings and inject malicious web scripts through forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (Wordfence Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker needs to craft a specific request and convince a site administrator to perform certain actions, such as clicking on a link, while they are authenticated (NVD Database).

Website administrators running the Floating Social Buttons plugin should update to a version newer than 1.5 if available, or consider implementing additional security measures to protect against CSRF attacks (NVD Database).