¿Es seguro Mystickyelements?

Qué hace este plugin

• Slug: mystickyelements
• 40000+ instalaciones activas

call now buttoncontact formfacebook messengerInstagramwhatsapp

Estado de mantenimiento

• Última versión conocida: 2.3.8
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

6 CVEs conocidos registrados para Mystickyelements. Reportadas entre 2022 y 2025.

CVE-2025-14428

The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all versions up to, and including, 2.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all contact form leads stored by the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-68995

The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-51362

Update the WordPress All-in-one Floating Contact Form – My Sticky Elements plugin to the latest available version (at least 2.1.4). Revan Arifio discovered and reported this Broken Access Control vulnerability in WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.1.4. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-3248

Update the WordPress All-in-one Floating Contact Form – My Sticky Elements plugin to the latest available version (at least 2.1.2). Dipak Panchal (th3.d1pak) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.1.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-0487

The My Sticky Elements plugin for WordPress is vulnerable to SQL Injection via the 'delete_message' parameter in versions up to, and including, 2.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0148

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Cómo solucionarlo

Mantén Mystickyelements actualizado — 2.3.8 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Contact Form 7 — 10000000+ instalaciones activas — 80/100 (2174) — PHP máx. 8.4
• Akismet Anti-spam: Spam Protection — 6000000+ instalaciones activas — 94/100 (1184) — PHP máx. 8.4
• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ instalaciones activas — 96/100 (14354)
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ instalaciones activas — 96/100 (777) — PHP máx. <8.0
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ instalaciones activas — 96/100 (2098)