CVE-2024-0703

The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3024941%40sticky-buttons&new=3024941%40sticky-buttons&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c070be-e955-4076-9878-0b1044766397?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3024941%40sticky-buttons&new=3024941%40sticky-buttons&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c070be-e955-4076-9878-0b1044766397?source=cvePatch, Third Party Advisory

Published

Jan 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0697The Backuply – Backup, Restore, Migrate and Clone plugin for…4.9
• CVE-2024-0698The Easy!Appointments plugin for WordPress is vulnerable to …5.4
• CVE-2024-0699The AI Engine: Chatbots, Generators, Assistants, GPT 4 and m…7.2
• CVE-2024-0700The Simple Tweet plugin for WordPress is vulnerable to Store…5.4
• CVE-2024-0701The UserPro plugin for WordPress is vulnerable to Security F…5.3
• CVE-2024-0702The Oliver POS – A WooCommerce Point of Sale (POS) plugin fo…7.3
• CVE-2024-0704Rejected reason: very low impact - impractical to correct
• CVE-2024-0705The Stripe Payment Plugin for WooCommerce plugin for WordPre…7.5
• CVE-2024-0706Rejected reason: ***REJECT*** This was a false positive repo…
• CVE-2024-0707Rejected reason: **REJECT** Not a valid vulnerability.
• CVE-2024-0708The Landing Page Cat – Coming Soon Page, Maintenance Page & …5.3
• CVE-2024-0709The Cryptocurrency Widgets – Price Ticker & Coins List plugi…7.5