TI-2022-02191 Aliases CVE-2022-2375 GHSA-fp9w-4hqx-5jxj

WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS

LOW 24CWE-352Published 2022-08-22 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Tampering, Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-79.

Summary

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues

Why it matters now

EPSS 0.00365 30th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed WP Sticky Button – Click to Chat (Unknown): 1.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	WP Sticky Button – Click to Chat	1.4.1 to before 1.4.1	1.4.1	Patch available	CNA

WP Sticky Button – Click to Chat VendorUnknown Affected 1.4.1 to before 1.4.1 Fixed in 1.4.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:okapitech:wp_sticky_button::::::wordpress::*	before 1.4.1	Vulnerable	Okapitech

cpe:2.3:a:okapitech:wp_sticky_button:*:*:*:*:*:wordpress:*:* Versions before 1.4.1 Vulnerable ·Okapitech

Remediation

Fix · CNA WP Sticky Button – Click to Chat (Unknown) Fixed in 1.4.1

Timeline

2026-10-02 Threatist record created from CVE-2022-2375
2026-10-03 Alias added: GHSA-fp9w-4hqx-5jxj

References

Exploit 1

https://wpscan.com/vulnerability/caab1fca-cc6b-45bb-bd0d-f857edd8bb81

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences