The WP Sticky Side Buttons plugin for WordPress contains a Cross‑Site Request Forgery flaw that enables an attacker to send forged HTTP requests to the site. Those requests can inject arbitrary HTML or JavaScript payloads, which the plugin stores and later renders to visitors, resulting in stored cross‑site scripting. The weakness is classified as CWE‑352 and can compromise confidentiality, integrity, and availability by allowing an attacker to inject malicious code into the site’s front‑end.

Any WordPress installation using the Mustafa KUCUK WP Sticky Side Buttons plugin version 2.1 or earlier is vulnerable. Site administrators who have not upgraded to a patched release or a newer major version remain at risk.

The vulnerability carries a CVSS score of 7.1, indicating a high‑risk condition. The EPSS score is less than 1 %, showing a currently low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is that an attacker forces a logged‑in administrator or privileged user to submit a malicious request, for example by embedding the URL in a link or form. Successful exploitation requires the victim to be authenticated on the site and to grant the plugin permission to store the injected payload.