blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-2375

MEDIUM 5.4 CVSS 3.1
Published
August 22, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79, CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues

Affected products and versions

  • Unknown WP Sticky Button – Click to Chat — From 1.4.1 (including) to 1.4.1 (excluding)
  • okapitech wp_sticky_button — Before 1.4.1

References

  • wpscan.com https://wpscan.com/vulnerability/caab1fca-cc6b-45bb-bd0d-f857edd8bb81 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record