Easy Sticky Sidebar Vulnerabilities

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VAL...

CVSS:

4.9

Affected:

2.1.2 – 2.1.2

Fixed in:

2.1.3

Disclosed:

Jul 28, 2026

CVE-2026-6089 on NVD →

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparati...

CVSS:

7.5

Affected:

up to 2.2.2

Fixed in:

2.3.0

Disclosed:

Jul 10, 2026

CVE-2026-4661 on NVD →

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Mar 3, 2026

CVE-2026-22459 on NVD →

The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthent...

CVSS:

5.3

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Aug 1, 2025

CVE-2025-8152 on NVD →

The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized...

CVSS:

4.3

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Jun 27, 2025

CVE-2025-53270 on NVD →

The WordPress CTA plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX actions in versions up to, and including, 1.5.8. This makes it possible for unauthenticated attackers to perform unauthorized actions, such as adding new call to actions.

CVSS:

6.5

Affected:

up to 1.5.8

Fixed in:

1.5.9

Disclosed:

Oct 25, 2023

CVE-2023-46644 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 1.5.8

Fixed in:

1.5.9

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 1.5.8

Fixed in:

1.5.9

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →