The Sticky plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping in the cvmh_sticky_front_render() function. Specifically, the readmoretext attribute of the cvmh-sticky shortcode is passed through apply_filters() and concatenated directly into HTML output without escaping functions like esc_html(). This flaw allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of users viewing affected pages.

An attacker with Contributor-level access or above can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to theft of user credentials, session hijacking, or other malicious actions executed in the context of site visitors. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent as reflected by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None).

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Until a patch is released, site administrators should restrict Contributor-level access carefully and consider disabling or removing the Sticky plugin if possible. Monitor vendor advisories for updates regarding a fix.