CVE-2026-6397
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in versions up to and including 2.5.6.
Published May 20, 2026 · updated Jul 24, 2026
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the function — the attribute value is passed through and directly concatenated into the HTML output without any escaping function such as . This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the injected shortcode.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 20, 2026 · NIST NVD
Detected
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the function — the attribute value is passed through and directly concatenated into the HTML output without any escaping function such as . This makes it possible for authenticated attac
Jul 24, 2026 · NIST NVD
Updated
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the function — the attribute value is passed through and directly concatenated into the HTML output without any escaping function such as . This makes it possible for authenticated attac
Sources
- CVE.orgVulnerability recordCVE-2026-6397
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-6397
The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the func
nvd.nist.gov