Now officially on WordPress.org

CVE Database / CVE-2025-14428

CVE · Medium

CVE-2025-14428 — All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.3.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-14428 All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.3.4 Missing Authorization Medium 4.3 < 2.3.4 2.3.4 2025-12-31 —

CVE-2025-14428

The My Sticky Elements plugin for WordPress, specifically versions up to and including 2.3.3, is susceptible to unauthorized data loss. Authenticated users with at least Subscriber-level access can exploit a missing capability check in the 'my_sticky_elements_bulks' function to delete all contact form leads managed by the plugin.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings