CVE-2026-6397

Name of the Vulnerable Software and Affected Versions Sticky versions prior to 2.5.7

Description The Sticky plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the cvmh sticky front render() function fails to properly sanitize input and escape output for the readmoretext attribute within the cvmh-sticky shortcode. Specifically, the value of the readmoretext attribute is processed via apply filters() and concatenated into the HTML output without using escaping functions like esc html(). Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits a page containing the malicious shortcode.

Recommendations Update to a version later than 2.5.6. As a temporary workaround, restrict the ability of users with Contributor-level access to edit pages or use the cvmh-sticky shortcode until the update is applied.