Executive brief
The Sticky plugin for WordPress, which allows users to create sticky elements on their websites, contains a security flaw that allows certain users to inject malicious code into pages. An attacker with contributor-level access or higher can use a specific shortcode to embed scripts that will run in the browsers of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site visitors or administrators, potentially compromising the site's integrity or user data.
Technical details
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the cvmh_sticky_front_render() function. Specifically, the 'readmoretext' attribute of the 'cvmh-sticky' shortcode is passed through apply_filters() and concatenated into the HTML output without being processed by an escaping function like esc_html(). This vulnerability allows authenticated attackers with Contributor-level permissions or higher to inject arbitrary JavaScript into a page. The script is stored on the server and executes in the context of any user's browser who views the page containing the malicious shortcode. The issue exists in versions up to and including 2.5.6.
Affected products
- Sticky Sticky up to and including 2.5.6
Timeline
- 2026-05-20: disclosed: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/sticky/tags/2.5.6/includes/functions.php
- https://plugins.trac.wordpress.org/browser/sticky/tags/2.5.6/includes/shortcode.php
- https://plugins.trac.wordpress.org/browser/sticky/trunk/includes/functions.php
- https://plugins.trac.wordpress.org/browser/sticky/trunk/includes/shortcode.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/135783c5-8175-4775-a013-f1e2bef04479?source=cve