Skip to content
OpenAdvisories

Vendor

Premio

24 known vulnerabilities.

Products

Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager 6 Chaty 3 My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) 2 Stars Testimonials — Responsive Reviews & Star Ratings 2 Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce 2 Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty 2 Folders Pro 2 My Sticky Elements 2 All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements 1 Stars Testimonials 1 Chaty (WordPress plugin) 1 Chaty Pro 1
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-18964

    Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting

    The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.5.9 due to …

    Premio Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Web / CMS
  • Medium 4.3
    CVE-2025-12640

    Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement

    The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level author…

    Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Web / CMS
  • Medium 4.3
    CVE-2025-14428

    My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion

    The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all ve…

    Premio All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements Web / CMS
  • Medium 4.3
    CVE-2025-68995

    WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

    Premio My Sticky Elements
  • Medium 6.5
    CVE-2025-67912

    WordPress Stars Testimonials plugin <= 3.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-and-masonry-grid allows Stored XSS.This issue affects Stars Testimonials: from n/a through <= 3.3.4.

    Premio Stars Testimonials
  • Medium 4.3
    CVE-2025-12971

    Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation

    The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versio…

    Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Web / CMS
  • Medium 6.4
    CVE-2025-1450

    Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

    The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-hover’ parameter in all versions up to, and includin…

    Premio Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Web / CMS
  • Medium 5.4
    CVE-2024-12204

    Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization

    The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and…

    Premio Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-51362

    WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.

    Premio My Sticky Elements
  • Medium 6.4
    CVE-2024-8989

    Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode

    The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stars_testimonials shortcode in all versions up to, and including, 3.3.1 due t…

    Premio Stars Testimonials — Responsive Reviews & Star Ratings Web / CMS
  • Medium 6.4
    CVE-2024-7317

    Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload

    The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.3 due to insufficient input sanitizat…

    Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Web / CMS
  • Medium 4.3
    CVE-2024-2023

    Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_upload

    The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders Pro via the 'handle_folders_file_upload' function. This makes it possible for authenticated attacke…

    Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Folders Pro Web / CMS
  • Medium 5.4
    CVE-2024-3868

    Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name

    The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenti…

    Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Web / CMS
  • Medium 5.9
    CVE-2023-47759

    WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affects Chaty: from n/a through <= 3.1.2.

    Premio Chaty
  • Medium 4.8
    CVE-2021-36846

    WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3

    Premio Chaty (WordPress plugin) Web / CMS