CVE-2022-0148: All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-07 · updated 2026-06-17
Weakness: CWE-79

Description

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.

Affected products

All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs – My Sticky Elements: before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs – My Sticky Elements 2.0.4. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2654453/mystickyelements
https://wpscan.com/vulnerability/37665ee1-c57f-4445-9596-df4f7d72c8cd
https://plugins.trac.wordpress.org/changeset/2654453/mystickyelements
https://wpscan.com/vulnerability/37665ee1-c57f-4445-9596-df4f7d72c8cd

Get alerted when CVE-2022-0148 or the next vulnerability affects your stack