CVE-2024-2643 in Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Plugin
Summary
by MITRE • 05/16/2025
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/11/2025
The vulnerability identified as CVE-2024-2643 affects the Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin versions prior to 2.6.8. This represents a critical security flaw that undermines the core security model of WordPress installations, particularly in multisite environments where strict capability controls are enforced. The issue stems from insufficient input validation and output escaping mechanisms within the plugin's administrative interfaces, creating a pathway for privilege escalation through stored cross-site scripting attacks. The vulnerability specifically targets settings that are processed and stored within the WordPress database, making it particularly dangerous as the malicious payloads persist and execute whenever affected pages are loaded.
The technical implementation of this vulnerability resides in the plugin's failure to properly sanitize user inputs across multiple administrative settings. According to CWE-79, this constitutes a classic stored cross-site scripting vulnerability where malicious scripts are stored on the server and executed when other users access affected pages. The flaw occurs because the plugin does not adequately escape HTML content before storing it in the database, nor does it properly validate the content during administrative input processing. This allows high-privilege users with administrative capabilities to inject malicious JavaScript code through various plugin settings interfaces, including notification bars, sticky menus, announcement banners, and header configurations. The vulnerability is particularly concerning because it operates even when the unfiltered_html capability is restricted, which is a standard security practice in multisite WordPress installations where only super administrators should have unrestricted HTML capabilities.
The operational impact of CVE-2024-2643 extends beyond simple XSS attacks as it enables attackers with administrator privileges to potentially compromise entire WordPress networks. In multisite environments, where administrators may have varying levels of access and security controls are enforced, this vulnerability allows for unauthorized code execution that could lead to complete system compromise. Attackers could leverage this vulnerability to execute malicious scripts that steal administrator credentials, modify content, install backdoors, or redirect users to phishing sites. The persistent nature of stored XSS means that once the malicious code is injected, it will execute automatically for all users who view the affected pages, potentially affecting thousands of users across multiple sites within a single network. This vulnerability directly violates the principle of least privilege and undermines the security model of WordPress multisite setups where capability restrictions are deliberately implemented to prevent unauthorized access.
Mitigation strategies for CVE-2024-2643 should prioritize immediate plugin updates to version 2.6.8 or later, which contain the necessary sanitization and escaping fixes. Organizations should also implement additional monitoring for suspicious administrative activities and conduct thorough security audits of all installed plugins to identify similar vulnerabilities. The WordPress security team recommends that administrators verify their plugin installations and ensure that all plugins are updated to their latest versions to prevent exploitation. Additionally, organizations should consider implementing web application firewalls and content security policies as additional layers of protection. According to ATT&CK framework category T1548.005, this vulnerability could be exploited to establish persistence through malicious code injection, making it essential for security teams to monitor for unusual administrative activities and implement proper access controls. The vulnerability also highlights the importance of proper input validation and output escaping practices in web application development, particularly in CMS environments where plugins extend core functionality with potential security implications.