Key Vulnerability Information CVE: CVE-2025-14428 CVSS Score: 4.3 (Medium) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Vulnerability Type: Missing Authorization Publicly Published: December 31, 2025 Last Updated: January 1, 2026 Researcher: shark3 Affected Software Software Type: Plugin Software Slug: mystickyelements Affected Version: <= 2.3.3 Patched Version: 2.3.4 Description The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all versions up to, and including, 2.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all contact form leads stored by the plugin. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org