CVE-2024-7133

CVE-2024-7133 affects the WordPress plugin My Sticky Bar (and related descriptions refer to the Floating Notification Bar/Sticky Bar settings) for versions before 2.7.3 . The root cause is failure to validate and escape certain plugin settings before outputting them in the page, enabling stored X...

CVE-2024-2643

CVE-2024-2643 affects the WordPress plugin My Sticky Bar prior to version 2.6.8. The issue is a failure to sanitize/escape certain settings, enabling stored cross-site scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, such as in multisite setup...

CVE-2024-4090

CVE-2024-4090 affects WordPress plugin My Sticky Bar (formerly myStickymenu) up to version 2.7.1. The issue is an admin/high-privilege stored XSS due to the plugin not sanitising or escaping certain settings, enabling an authenticated attacker to inject scripts. Patchstack and CVE records confirm...

CVE-2023-7048

CVE-2023-7048 affects the WordPress plugin My Sticky Bar (formerly myStickymenu) up to version 2.6.6. The issue is a Cross-Site Request Forgery caused by missing/incorrect nonce validation in mystickymenu-contact-leads.php, enabling unauthenticated attackers to trigger a CSV export containing con...