PT-2026-42062 · WordPress · Sticky

Djaidja Moundjid · Published 2026-05-20 · Updated 2026-05-28 · CVE-2026-6397

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sticky versions prior to 2.5.7

Description The Sticky plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the cvmh sticky front render() function fails to properly sanitize input and escape output for the readmoretext attribute within the cvmh-sticky shortcode. Specifically, the value of the readmoretext attribute is processed via apply filters() and concatenated into the HTML output without using escaping functions like esc html(). Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits a page containing the malicious shortcode.

Recommendations Update to a version later than 2.5.6. As a temporary workaround, restrict the ability of users with Contributor-level access to edit pages or use the cvmh-sticky shortcode until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6397

Affected Products

Sticky

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-6397 · Security Note
• https://t.me/CVEtracker/54310 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/135783c5-8175-4775-a013-f1e2bef04479?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1tqd1k6/critical_38_plugins_no_fix_no_mercy_if_youve_got · Reddit Post
• https://plugins.trac.wordpress.org/browser/sticky/tags/2.5.6/includes/functions.php#L118 · Note
• https://plugins.trac.wordpress.org/browser/sticky/trunk/includes/functions.php#L118 · Note
• https://plugins.trac.wordpress.org/browser/sticky/tags/2.5.6/includes/shortcode.php#L7 · Note
• https://plugins.trac.wordpress.org/browser/sticky/trunk/includes/shortcode.php#L7 · Note