The Sticky Buttons – Floating Buttons Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator privileges can inject arbitrary scripts via sticky URLs because the plugin fails to properly sanitize and escape input/output. This vulnerability affects multi-site WordPress setups or installations where the unfiltered_html capability is disabled, potentially allowing malicious script execution when other users access the compromised pages. The CVSS 3.1 base score is 4.4, reflecting a medium impact with network attack vector, high attack complexity, and required privileges. No patch or remediation details are currently provided by the vendor.

An authenticated attacker with administrator-level access on affected WordPress multi-site installations or sites with unfiltered_html disabled can inject and store malicious scripts via sticky URLs. These scripts execute in the context of users visiting the injected pages, potentially leading to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L). There is no reported impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Sticky Buttons – Floating Buttons Builder plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates or official patches.