The Zen Sticky Social plugin for WordPress suffers from a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation on a plugin page. Unauthenticated attackers can craft a forged request that, when executed by a site administrator, modifies the plugin settings and injects malicious scripts into the site. These scripts are stored and executed whenever site content is rendered, giving attackers the ability to run arbitrary JavaScript in the context of visitors or administrators, potentially leading to data theft, defacement or credential compromise.

All installations of the Zen Sticky Social plugin by bogdanding, up to and including version 0.3, running on WordPress sites.

The vulnerability has a CVSS score of 6.1 and an EPSS score of less than 1 %, indicating a moderate severity but a very low probability of active exploitation. It is not listed in CISA’s KEV catalog. Attackers would need to lure an administrator to trigger the forged request, typically via a malicious link or email. Once the request is processed, stored XSS payloads are injected, providing long‑term access to the site’s front‑end and potentially the admin interface if the payload is crafted accordingly.