CVE-2026-6089: Server-Side Request Forgery (SSRF)

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2026-4661: Improper Neutralization of Special Elements used in an SQL Command

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck method...

EUVD-2023-50846

Malicious code in bioql PyPI...

EUVD-2025-23424

Malicious code in bioql PyPI...

CVE-2025-8152 WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update

The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatectastatus' and 'changestickysidebarname' functions in all versions up to, and including, 1.7.0. This makes it...

PT-2025-31726 · WordPress · Sticky Buttons +2

Name of the Vulnerable Software and Affected Versions: WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons versions prior to 1.7.1 Description: The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is susceptible to unauthorized data modification due to a...

CVE-2025-8152: Missing Authorization

The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatectastatus' and 'changestickysidebarname' functions in all versions up to, and including, 1.7.0. This makes it...

CVE-2023-46644

Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8...