Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

62 results · page 1 of 2

Sep 11, 2026Sticky Chat Widget: SQL InjectionCVE-2026-15462 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Sticky Chat Widget
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Sticky Chat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 18, 2026Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73187 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales: Time-based blind SQL InjectionCVE-2026-4661 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.
Product
WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2026WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons: Stored Cross-Site ScriptingCVE-2026-4811 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2026Sticky: Stored Cross-Site ScriptingCVE-2026-6397 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `cvmh-sticky` shortcode `readmoretext` attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the `cvmh_sticky_front_render()` function — the `readmoretext` attribute value is passed through `apply_filters()` and directly concatenated into the HTML output without any escaping function such as `esc_html()`. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the injected shortcode.
Product
Sticky
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Sticky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026My Sticky Bar: SQL injectionCVE-2026-3657 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.
Product
My Sticky Bar
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update My Sticky Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Sticky Action Buttons: Cross-Site Request ForgeryCVE-2025-14465 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the sabs_options_page_form_submit() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Sticky Action Buttons
Affected
up to 1.1
What to do
Affects up to 1.1. Update Sticky Action Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 1, 2026All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements: Unauthorized data lossCVE-2025-14428 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all versions up to, and including, 2.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all contact form leads stored by the plugin.
Product
All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025Sticky Notes for WP Dashboard: Missing AuthorizationCVE-2025-62087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
Product
Sticky Notes for WP Dashboard
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Sticky Notes for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025My Sticky Elements: Missing AuthorizationCVE-2025-68995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.
Product
My Sticky Elements
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Sticky Header Effects for Elementor: Missing AuthorizationCVE-2025-58251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in POSIMYTH Sticky Header Effects for Elementor sticky-header-effects-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header Effects for Elementor: from n/a through <= 2.1.2.
Product
Sticky Header Effects for Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Sticky Header Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025Sticky Side Buttons: Does not sanitise and escape some of its settingsCVE-2023-3666 · WordPress plugins & themes · reported by WPScanLow 3.3
The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Sticky Side Buttons
Fixed in
2.0.0
What to do
Update Sticky Side Buttons to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 20, 2025Apollo - Sticky Full Width HTML5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through <= 3.4.
Product
Apollo - Sticky Full Width HTML5 Audio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Apollo - Sticky Full Width HTML5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 2, 2025WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons: Unauthorized modification of dataCVE-2025-8152 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
Product
WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2025Simple Sticky Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50019 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandor Kovacs Simple Sticky Footer simple-sticky-footer allows Stored XSS.This issue affects Simple Sticky Footer : from n/a through <= 1.3.5.
Product
Simple Sticky Footer
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Simple Sticky Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 14, 2025Zen Sticky Social: Cross-Site Request ForgeryCVE-2025-6055 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zen Sticky Social
Affected
up to 0.3
What to do
Affects up to 0.3. Update Zen Sticky Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2025Sticky Radio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows Reflected XSS.This issue affects Sticky Radio Player: from n/a through <= 3.4.
Product
Sticky Radio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Experto CTA Widget – Call To Action, Sticky CTA, Floating Button: Missing AuthorizationCVE-2025-47529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UX Design Experts Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin experto-cta-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin: from n/a through <= 1.1.1.
Product
Experto CTA Widget – Call To Action, Sticky CTA, Floating Button
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Experto CTA Widget – Call To Action, Sticky CTA, Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Foodbakery Sticky Cart: Deserialization of Untrusted DataCVE-2025-39356 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
Product
Foodbakery Sticky Cart
Affected
up to 3.2
What to do
Affects up to 3.2. Update Foodbakery Sticky Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sticky HTML5 Music Player: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32290 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 allows SQL Injection.This issue affects Sticky HTML5 Music Player: from n/a through <= 3.1.6.
Product
Sticky HTML5 Music Player
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Sticky HTML5 Music Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sticky Radio Player: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31926 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows SQL Injection.This issue affects Sticky Radio Player: from n/a through <= 3.4.
Product
Sticky Radio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-2643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.6.8
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2025WP Sticky Side Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-39421 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through <= 2.1.
Product
WP Sticky Side Buttons
Affected
up to 2.1
What to do
Affects up to 2.1. Update WP Sticky Side Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Simple Sticky Add To Cart For WooCommerce: Missing AuthorizationCVE-2025-31854 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce sticky-add-to-cart-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through <= 1.4.9.
Product
Simple Sticky Add To Cart For WooCommerce
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Simple Sticky Add To Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31610 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme gp-notification-bar allows Stored XSS.This issue affects Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme: from n/a through <= 1.1.
Product
Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any
Affected
up to 1.1
What to do
Affects up to 1.1. Update Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Sticky Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.
Product
Sticky Content
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Sticky Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Sticky Header On Scroll: Missing AuthorizationCVE-2025-27356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header On Scroll: from n/a through <= 1.0.
Product
Sticky Header On Scroll
Affected
up to 1.0
What to do
Affects up to 1.0. Update Sticky Header On Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Sticky Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-24720 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Sticky Buttons sticky-buttons allows Cross Site Request Forgery.This issue affects Sticky Buttons: from n/a through <= 4.1.1.
Product
Sticky Buttons
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Sticky Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Sticky Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through <= 1.0.
Product
Sticky Button
Affected
up to 1.0
What to do
Affects up to 1.0. Update Sticky Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024My Sticky Elements: Missing AuthorizationCVE-2023-51362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.
Product
My Sticky Elements
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Sticky Social Icons: Does not sanitise and escape some of its settingsCVE-2024-10551 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sticky Social Icons
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 2, 2024Sticky Social Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52491 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanil Shakya Sticky Social Icons sticky-social-icons allows Stored XSS.This issue affects Sticky Social Icons: from n/a through <= 1.2.1.
Product
Sticky Social Icons
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 23, 2024MP3 Sticky Player: Directory TraversalCVE-2024-10803 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version.
Product
MP3 Sticky Player
Affected
up to 8.0
What to do
Affects up to 8.0. Update MP3 Sticky Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 21, 2024Lazy load videos and sticky control: Stored Cross-Site ScriptingCVE-2024-11428 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lazy load videos and sticky control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lazy-load-videos-and-sticky-control' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lazy load videos and sticky control
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Lazy load videos and sticky control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 19, 2024Sticky Social Bar: Cross-Site Request Forgery (CSRF)CVE-2024-51631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Md Eftakhairul Islam Sticky Social Bar sticky-social-bar allows Cross Site Request Forgery.This issue affects Sticky Social Bar: from n/a through <= 2.0.
Product
Sticky Social Bar
Affected
up to 2.0
What to do
Affects up to 2.0. Update Sticky Social Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Buooy Sticky Header: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51699 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buooy Buooy Sticky Header buooy-sticky-header allows Reflected XSS.This issue affects Buooy Sticky Header: from n/a through <= 0.5.2.
Product
Buooy Sticky Header
Affected
up to 0.5.2
What to do
Affects up to 0.5.2. Update Buooy Sticky Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 13, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not validate and escape some of its settings before outputting them back in the pageCVE-2024-7133 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks.
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.7.3
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-4090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.7.2
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2024WpStickyBar: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6226 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WpStickyBar
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
WpStickyBar
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2024Sticky Social Media Icons: Missing AuthorizationCVE-2023-40672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1.
Product
Sticky Social Media Icons
Affected
up to 2.1
What to do
Affects up to 2.1. Update Sticky Social Media Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sticky banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidden Depth Sticky banner allows Stored XSS.This issue affects Sticky banner: from n/a through 1.2.0.
Product
Sticky banner
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Sticky banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Sticky Social Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34546 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allows DOM-Based XSS.This issue affects Sticky Social Link: from n/a through <= 2.0.1.
Product
Sticky Social Link
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Sticky Social Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Sticky Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3475 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
Product
Sticky Buttons
Fixed in
3.2.4
What to do
Update Sticky Buttons to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 29, 2024Sticky Anything: Cross-Site Request Forgery (CSRF)CVE-2024-33646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Sticky Anything allows Cross-Site Scripting (XSS).This issue affects Sticky Anything: from n/a through 2.1.5.
Product
Sticky Anything
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Sticky Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Sticky Anything: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Sticky Anything.This issue affects Sticky Anything: from n/a through 2.1.5.
Product
Sticky Anything
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Sticky Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content allows Stored XSS.This issue affects Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content: from n/a through 0.6.2.
Product
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 23, 2024Sticky Buttons – floating buttons builder: Stored Cross-Site ScriptingCVE-2024-0703 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Sticky Buttons – floating buttons builder
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Sticky Buttons – floating buttons builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024My Sticky Bar: Cross-Site Request ForgeryCVE-2023-7048 · WordPress plugins & themes · reported by WordfenceLow 3.1
The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated attackers to trigger the export of a CSV file containing contact leads via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Because the CSV file is exported to a public location, it can be downloaded during a very short window of time before it is automatically deleted by the export function.
Product
My Sticky Bar
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update My Sticky Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 29, 2023Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51361 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS.This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.
Product
Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.