blendmedia vulnerabilities

Products

• WP CTA – Call Now Button, Sticky Button & Call to Action Builder 3

Latest blendmedia CVEs

Newest publication first

1. CVE-2026-6089 WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery

   Published 2026-07-29

   Medium·CVSS 4.9 EPSS 0.48%

   The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to...

2. CVE-2026-4661 WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter

   Published 2026-07-11

   High·CVSS 7.5 EPSS 0.51%

   The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the...

3. CVE-2025-8152 WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update

   Published 2025-08-02

   Medium·CVSS 5.3 EPSS 0.33%

   The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.