Is my WordPress plugin safe?

• Jul 29, 2026WP CTA: Server-Side Request ForgeryCVE-2026-6089 · affects up to 2.1.2 · reported by WordfenceMedium 4.9

  The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response content is saved as a WordPress media attachment, making this a full-read SSRF.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 11, 2026WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales: Time-based blind SQL InjectionCVE-2026-4661 · affects up to 2.2.2 · reported by WordfenceHigh 7.5

  The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 5, 2026WordPress CTA: Missing AuthorizationCVE-2026-22459 · affects up to 2.1.2 · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through <= 2.1.2.

  NVD recordpatchstack.com

• Aug 2, 2025WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons: Unauthorized modification of dataCVE-2025-8152 · affects up to 1.7.0 · reported by WordfenceMedium 5.3

  The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 27, 2025WordPress CTA: Cross-Site Request Forgery (CSRF)CVE-2025-53270 · affects up to 1.7.0 · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.

  NVD recordpatchstack.com

• Jan 2, 2025WordPress CTA: Missing AuthorizationCVE-2023-46644 · affects up to 1.5.8 · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8.

  NVD recordpatchstack.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.