Advisories · Technology
blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder.
Every CVE that names blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.9 Medium
WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery
- blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder
- Server-side request forgery (SSRF)
- CVSS 7.5 High
WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
- blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder
- SQL injection
- CVSS 5.3 Medium
WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update
- blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder
- Broken access control