PLUGIN SECURITY
Is Call Now Button safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Call Now Button WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
call-now-button - Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Call Now Button – The #1 Click to Call Button for WordPress [call-now-button] < 1.1.2 [CVE-2022-1455, WordPress Call Now Button plugin <= 1.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability, Call Now Button < 1.1.2 - Reflected Cross-Site Scripting, Call Now Button <= 1.1.1 - Reflected Cross-Site Scripting]
- Call Now Button – The #1 Click to Call Button for WordPress [call-now-button] < 1.4.7 [CVE-2024-2908, WordPress Call Now Button Plugin < 1.4.7 is vulnerable to Cross Site Scripting (XSS), Call Now Button <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting]
- Call Now Button – The #1 Click to Call Button for WordPress [call-now-button] < 1.4.14 [CVE-2025-24738, WordPress Call Now Button Plugin <= 1.4.13 is vulnerable to Cross Site Request Forgery (CSRF), Call Now Button <= 1.4.13 - Cross-Site Request Forgery, EUVD-2025-3928]
- Call Now Button – The #1 Click to Call Button for WordPress [call-now-button] < 1.5.4 [CVE-2025-11587, Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update]
- Call Now Button – The #1 Click to Call Button for WordPress [call-now-button] < 1.5.5 [CVE-2025-11632, Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- WP Call Button – Easy Click to Call Button for WordPress — 40000+ active installs — max PHP 8.4
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements — 40000+ active installs — max PHP 8.4
- Really Simple Click To Call Bar — 8000+ active installs — max PHP 8.4
- Button Generator – Easily Create Custom Buttons with Icons and Analytics — 5000+ active installs
- Floating Button – Easily Create Sticky, Fixed & Floating Buttons — 4000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.