PLUGIN SECURITY
Is Mystickyelements safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Mystickyelements WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
mystickyelements - Max supported PHP (analyzed): 8.4
Known vulnerabilities
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.0.4 [CVE-2022-0148, WordPress All-in-one Floating Contact Form plugin <= 2.0.3 - Reflected Cross-Site Scripting (XSS) vulnerability, All-in-one Floating Contact Form <= 2.0.3 - Reflected Cross-Site Scripting, All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)]
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.0.9 [CVE-2023-0487, My Sticky Elements <= 2.0.8 - Authenticated (Admin+) SQL Injection, WordPress All-in-one Floating Contact Form Plugin < 2.0.9 is vulnerable to SQL Injection, My Sticky Elements < 2.0.9 - Admin+ SQLi]
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.1.2 [CVE-2023-3248, WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin < 2.1.2 is vulnerable to Cross Site Scripting (XSS), All-in-one Floating Contact Form <= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings, All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting]
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.1.4 [CVE-2023-51362, WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin <= 2.1.3 is vulnerable to Broken Access Control, All-in-one Floating Contact Form – My Sticky Elements <= 2.1.3 - Missing Authorization, All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action]
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.3.4 [CVE-2025-68995, My Sticky Elements <= 2.3.3 - Missing Authorization]
+ 1 more known vulnerability
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements [mystickyelements] < 2.3.4 [CVE-2025-14428, My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion, EUVD-2026-0015]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Contact Form 7 — 10000000+ active installs — max PHP 8.4
- Akismet Anti-spam: Spam Protection — 6000000+ active installs — max PHP 8.4
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ active installs — max PHP <8.0
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.