premio Vulnerabilities and Affected Products
Vulnerabilities associated with My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu).
Products
Clear product- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager6 vulnerabilities
- Chaty4 vulnerabilities
- Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce2 vulnerabilities
- Folders Pro2 vulnerabilities
- My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)2 vulnerabilities
- My Sticky Elements2 vulnerabilities
- my_sticky_bar2 vulnerabilities
- Stars Testimonials — Responsive Reviews & Star Ratings2 vulnerabilities
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements1 vulnerability
- all_in_one_floating_contact_form_my_sticky_elements1 vulnerability
- Chaty (WordPress plugin)1 vulnerability
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty1 vulnerability
- floating_chat_widget1 vulnerability
- folders1 vulnerability
- folders_pro1 vulnerability
- My Sticky Bar1 vulnerability
- Stars Testimonials1 vulnerability
- testimonials1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-3657HIGH | My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' ActionThe My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthent… CWE-89Mar 12, 2026 | CVSS7.5v3.1 | EPSS0.338% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information ExposureThe My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated attackers to trigger the export of a CSV file containing contact leads via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Because the CSV file is exported to a public locati… CWE-352Jan 11, 2024 | CVSS3.1v3.1 | EPSS0.211% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |