The WP Sticky Side Buttons plugin for WordPress, developed by Mustafa KUCUK, contains a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 2.1. The vulnerability allows remote attackers to trick authenticated users into submitting forged requests, which can result in malicious scripts being stored and executed in the context of the affected site. The CVSS 3.1 base score is 7.1, reflecting the network attack vector, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the victim's browser, potentially compromising user data and site integrity. The vulnerability affects confidentiality, integrity, and availability to a limited extent. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP Sticky Side Buttons plugin or applying any recommended temporary mitigations from the vendor. Monitor official sources for updates and apply patches promptly once released.