CVE-2026-3657highobserved exploitationCWE-89

CVE-2026-3657: high-severity vulnerability in premio My Sticky Bar – Floating Notification…

My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action

Published · Updated

Follow this CVE+ Monitor My Sticky Bar – Floating Notification Bar & Sticky Header

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 7.5epss 0.4%
from disclosure to weapon
Published on NVDMar 12
VulnCheckMar 12
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
premio · My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)
Related CVEs — premio My Sticky Bar – Floating Notification…

In the same product, most dangerous first.

CVE-2023-7048LOWMy Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information ExposureEPSS 0.2%