Skip to content
OpenAdvisories

Vendor

Blend Media

5 known vulnerabilities.

Products

WP CTA – Call Now Button, Sticky Button & Call to Action Builder 3 WordPress CTA 2
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-6089

    WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery

    The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from i…

    Blend Media WP CTA – Call Now Button, Sticky Button & Call to Action Builder Web / CMS
  • Medium 6.5
    CVE-2026-22459

    WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through <= 2.1.2.

    Blend Media WordPress CTA Web / CMS
  • Medium 5.3
    CVE-2025-8152

    WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update

    The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up t…

    Blend Media WP CTA – Call Now Button, Sticky Button & Call to Action Builder Web / CMS
  • Medium 4.3
    CVE-2025-53270

    WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.

    Blend Media WordPress CTA Web / CMS