Flarum Sticky vulnerabilities

• cvmh sticky Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute CVE-2026-6397 6.4 MediumMay 20, 2026
• flarum sticky XSS in Flarum Sticky extension. CVE-2021-21283 Fix available 5.4 MediumJanuary 26, 2021