Now officially on WordPress.org

CVE Database / CVE-2024-4090

CVE · Medium

CVE-2024-4090 — My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) [mystickymenu] < 2.7.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-4090 My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) [mystickymenu] < 2.7.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 4.8 < 2.7.2 2.7.2 2024-07-11 —

CVE-2024-4090

The My Sticky Bar plugin for WordPress versions up to 2.7.1 contains a stored cross-site scripting vulnerability in its administrator settings that results from inadequate input sanitization and output escaping. Authenticated administrators and higher-privileged users can inject malicious scripts that execute when other users view affected pages, though this vulnerability only impacts multisite WordPress installations or those with unfiltered_html disabled.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings