VDB
CVE-2023-3666
CVE-2023-3666
PUBLISHED
CVSS 3.3 LOW
Sticky Side Buttons < 2.0.0 - Admin+ Stored XSS
Reported by wpscan · Published September 3, 2025
The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| sticky_side_buttons | maevelander | 2.0.0 |
| Sticky Side Buttons | Unknown | 2.0.0 |
Risk scores
CVSS 3.1
3.3
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Sticky Side Buttons | 0 |
| Unknown | Sticky Side Buttons | 0 |
Timeline
- Nov 14, 2023 CVE Published
- Sep 3, 2025 EPSS Score (30 in total, the first dated here)
- Sep 3, 2025 PoC Published
- Mar 31, 2026 Security Advisory (2 in total, the first dated here)
- Jun 30, 2026 CVE Updated
- Aug 7, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-3666
vulnetix vdb fixes CVE-2023-3666Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-3666/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart