CVE-2026-18964Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Published 09/11/2026 Severity Medium CVE-2026-73360WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product C Chaty Pro Published 08/18/2026 Severity High CVE-2026-3657My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action Exploitation status Not known exploited Fix Affected product M My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) Published 03/12/2026 Severity High CVE-2026-27370WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product C Chaty Published 03/05/2026 Severity High CVE-2025-12640Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement Exploitation status Not known exploited Fix Affected product F Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Published 01/08/2026 Severity Medium CVE-2025-14428My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion Exploitation status Not known exploited Fix Affected product A All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements Published 01/01/2026 Severity Medium CVE-2025-68995WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M My Sticky Elements Published 12/30/2025 Severity Medium CVE-2025-67912WordPress Stars Testimonials plugin <= 3.3.4 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Stars Testimonials Published 12/16/2025 Severity Medium CVE-2025-12971Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation Exploitation status Not known exploited Fix Affected product F Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Published 11/27/2025 Severity Medium CVE-2024-2643My Sticky Bar < 2.6.8 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product F Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Published 05/15/2025 Severity Medium CVE-2025-1450Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Published 02/27/2025 Severity Medium CVE-2024-12204Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization Exploitation status Not known exploited Fix Affected product C Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce Published 01/11/2025 Severity Medium CVE-2024-12627Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection Exploitation status Not known exploited Fix Affected product C Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce Published 01/11/2025 Severity High CVE-2023-51362WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M My Sticky Elements Published 12/09/2024 Severity Medium CVE-2024-11429Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion Exploitation status Not known exploited Fix Affected product S Stars Testimonials — Responsive Reviews & Star Ratings Published 12/05/2024 Severity High CVE-2024-8989Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode Exploitation status Not known exploited Fix Affected product S Stars Testimonials — Responsive Reviews & Star Ratings Published 10/01/2024 Severity Medium CVE-2024-7133My Sticky Bar < 2.7.3 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product F Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Published 09/13/2024 Severity Medium CVE-2024-7317Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product F Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Published 08/06/2024 Severity Medium CVE-2024-4090My Sticky Bar < 2.7.2 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product F Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Published 08/01/2024 Severity Medium CVE-2024-2024Folders Pro <= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle_folders_file_upload Exploitation status Not known exploited Fix Affected product F Folders Pro Published 06/14/2024 Severity High CVE-2024-2023Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_upload Exploitation status Public exploit Fix Affected product F Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Published 06/14/2024 Severity Medium CVE-2024-4149Floating Chat Widget < 3.2.3 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product F Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Published 06/13/2024 Severity Medium CVE-2024-3868Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name Exploitation status Not known exploited Fix Affected product F Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Published 05/04/2024 Severity Medium CVE-2024-2972Floating Chat Widget < 3.1.9 - Editor+ Stored XSS Exploitation status Public exploit Fix Affected product F Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Published 04/24/2024 Severity Low CVE-2023-7048My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product M My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) Published 01/11/2024 Severity Low CVE-2023-40204WordPress Folders Plugin <= 2.9.2 is vulnerable to Arbitrary File Upload Exploitation status Not known exploited Fix Affected product F Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Published 12/20/2023 Severity Critical CVE-2023-47759WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product C Chaty Published 11/22/2023 Severity Medium CVE-2023-5509myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion Exploitation status Public exploit Fix Affected product F Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Published 11/20/2023 Severity Unknown CVE-2023-25019WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product C Chaty Published 08/30/2023 Severity High CVE-2023-3248All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting Exploitation status Public exploit Fix Affected product A All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs Published 07/24/2023 Severity Medium CVE-2023-3245Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting Exploitation status Public exploit Fix Affected product F Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Published 07/17/2023 Severity Medium CVE-2023-0487My Sticky Elements < 2.0.9 - Admin+ SQLi Exploitation status Public exploit Fix Affected product A All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs Published 02/27/2023 Severity High CVE-2022-3858Chaty < 3.0.3 - Admin+ SQLi Exploitation status Public exploit Fix Affected product F Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button Published 12/05/2022 Severity High CVE-2021-36846WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Not confirmed Affected product C Chaty (WordPress plugin) Published 04/11/2022 Severity Medium CVE-2022-0148All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product A All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs – My Sticky Elements Published 02/07/2022 Severity Unknown CVE-2021-25016Chaty < 2.8.3 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product F Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty Published 01/03/2022 Severity Unknown CVE-2021-24425myStickymenu < 2.5.2 - Authenticated Stored XSS Exploitation status Not confirmed Fix Affected product F Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu Published 08/02/2021 Severity Unknown 
.svg){kind=icon}
.svg){kind=icon}
