Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-30
Easy Sticky Sidebar - Server-Side Request Forgery (SSRF) (CVE-2026-6089)
The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response…
PLUGIN
Easy Sticky Sidebar
CVE-2026-6089
Risk Score
Threat Entry
Updated 2026-07-13
Easy Sticky Sidebar - SQL Injection (CVE-2026-4661)
The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract…
PLUGIN
Easy Sticky Sidebar
CVE-2026-4661
Risk Score
Threat Entry
Updated 2026-06-17
Easy Sticky Sidebar - Broken Access Control (CVE-2025-8152)
The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
PLUGIN
Easy Sticky Sidebar
CVE-2025-8152
Risk Score
Threat Entry
Updated 2026-06-17
Easy Sticky Sidebar - Cross-Site Request Forgery (CSRF) (CVE-2025-53270)
Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through
PLUGIN
Easy Sticky Sidebar
CVE-2025-53270
Risk Score