Vulnerabilities and security researches foreasy-sticky-sidebar easy-sticky-sidebar
Direction: ascendingJun 06, 2024
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # 64c4cc86fec741868a7da661556f73f312d61895
- CVE, Research URL
- Home page URL
- Date
- Sep 04, 2023
- Research Description
- WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin [easy-sticky-sidebar] < 1.5.9 WordPress WordPress CTA Plugin <= 1.5.6 is vulnerable to Cross Site Request Forgery (CSRF) No patched version is available. This plugin has been closed as of May 9, 2023 and is not available for download. Reason: Licensing/Trademark Violation. Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WordPress CTA Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has not been known to be fixed yet.
- Affected versions
-
max 1.5.9.
- Status
-
vulnerable
Jun 10, 2024
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # CVE-2023-46644
- CVE, Research URL
- Home page URL
- Date
- Jan 02, 2025
- Research Description
- Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8.
- Affected versions
-
max 1.5.9.
- Status
-
vulnerable
Jul 03, 2025
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # CVE-2025-53270
- CVE, Research URL
- Home page URL
- Date
- Jun 27, 2025
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.
- Affected versions
-
max 1.7.1.
- Status
-
vulnerable
Aug 04, 2025
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # CVE-2025-8152
- CVE, Research URL
- Home page URL
- Date
- Aug 02, 2025
- Research Description
- The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
- Affected versions
-
max 1.7.1.
- Status
-
vulnerable
Mar 31, 2026
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # CVE-2026-22459
- CVE, Research URL
- Home page URL
- Date
- Mar 05, 2026
- Research Description
- Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through <= 2.1.2.
- Affected versions
-
max 2.1.3.
- Status
-
vulnerable
Jul 13, 2026
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # CVE-2026-4661
- CVE, Research URL
- Home page URL
- Date
- Jul 11, 2026
- Research Description
- The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.
- Affected versions
-
max 2.3.0.
- Status
-
vulnerable
Jul 30, 2026
WP CTA – Call To Action Plugin, Sticky CTA, Floating Buttons, Floating Tab Plugin # CVE-2026-6089
- CVE, Research URL
- Home page URL
- Date
- Jul 29, 2026
- Research Description
- The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response content is saved as a WordPress media attachment, making this a full-read SSRF.
- Affected versions
-
max 2.1.3.
- Status
-
vulnerable