WP CTA – Call Now Button, Sticky Button & Call to Action Builder Security & Risk Analysis

The "easy-sticky-sidebar" plugin version 1.7.4 presents a mixed security posture. While it demonstrates good practices in utilizing prepared statements for SQL queries (66%) and proper output escaping (89%), several concerns warrant attention. The presence of 4 AJAX handlers, even though none are explicitly noted as unprotected in the static analysis, along with 4 flows with unsanitized paths identified during taint analysis, suggests potential avenues for attackers. The two high-severity taint flows are particularly concerning and require immediate investigation.

The plugin's vulnerability history is a significant red flag. With 5 known CVEs, including one that remains unpatched, and a consistent pattern of medium-severity vulnerabilities such as Missing Authorization and CSRF, this indicates a recurring struggle with robust security implementation. The fact that the last vulnerability was recently discovered (2026-03-03) and is still unpatched is a critical issue that elevates the risk considerably. While the plugin has strengths in its handling of SQL and output, the historical pattern and the current unpatched vulnerability cannot be overlooked.

In conclusion, the "easy-sticky-sidebar" plugin exhibits some positive security hygiene but is marred by a history of exploitable vulnerabilities and a currently unpatched security flaw. The taint analysis also reveals potential weaknesses. Users should exercise extreme caution, and the developers need to prioritize addressing the outstanding CVE and improving their code's resilience against authorization and CSRF attacks.