CVE-2022-2375

CVE-2022-2375: WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS

Vendor Unknown

Product WP Sticky Button – Click to Chat

Weakness CWE-79 · XSS

Published August 22, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2375 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-59767 Multiple vulnerabilities in AndSoft's e-TMS CVE-2021-24743 Podcast Subscribe Buttons < 1.4.2 - Contributor+ Stored XSS CVE-2025-22518 WordPress Justified Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-13196 Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget CVE-2025-11425 projectworlds Advanced Library Management System edit_admin.php cross site scripting