Skip to content
PluginCanary

WP CTA

WP CTA - Call Now Button, Sticky Button & Call to Action Builder
by Blend Media · 2,000+ active installs · Checked 3 Nov 2026
Watch1 Warning

Watch: tested up to WordPress 6.9.11, 2 major versions behind 7.1.4.

73/ 100 Canary Score
Sub-scores for WP CTA
Ownership100
Maintenance55
Security70
SupportNo data
ReputationNo data

How the score works

Quick answers

Is WP CTA still maintained?
Yes. Last release 6 May 2026, 16 releases in the last 24 months. 6 May 2026 · wordpress.org
Who owns WP CTA, and has it changed hands?
No change recorded. Main committer blendmedia since Jun 2020. 3 Nov 2026 · SVN log
Was WP CTA removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP CTA safe?
8 known vulnerabilities, all fixed (latest in 2.1.3). Not on the exploited list. 28 Jul 2026 · Wordfence Intelligence
Is the latest WP CTA update safe to install?
No ownership change before 2.3.0. No one-star spike after it. 6 May 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • WarningMNT-2Tested up to WordPress 6.9.11, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master8 Jun 2020 to 8 Jun 2020, 1 commits
blendmedia14 Jun 2020 to 1 Sep 2025, 193 commits
mandeeps198711 Feb 2026 to 6 May 2026, 46 commits

3 committers recorded. No ownership change since 2020.

Maintenance

Last release
6 months ago
Releases, 24 months
16
Tested up to
6.9 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP CTA
Q1 20241
Q2 20240
Q3 20241
Q4 20240
Q1 20254
Q2 20250
Q3 20251
Q4 20250
Q1 20267
Q2 20264
Q3 20260
Q4 20260

Last release 6 May 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.4.

Rating distribution
5 star6
4 star0
3 star0
2 star0
1 star1

Security record

5 vulnerabilities in 24 months (8 on record), all patched (latest fixed in 2.1.3).

Show 8 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
28 Jul 2026WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery4.92.1.22.1.3Patched before disclosure
10 Jul 2026WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter7.5<= 2.2.22.3.0Patched before disclosure
3 Mar 2026WP CTA - Sticky CTA Builder, Generate Leads, Promote Sales <= 2.1.2 - Missing Authorization5.3<= 2.1.22.1.324
1 Aug 2025WP CTA - Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update5.3<= 1.7.01.7.1n/a
27 Jun 2025WordPress CTA <= 1.7.0 - Cross-Site Request Forgery4.3<= 1.7.01.7.1n/a
25 Oct 2023WordPress CTA <= 1.5.8 - Missing Authorization via Multiple AJAX Actions6.5<= 1.5.81.5.9149
16 Dec 2022Appsero <= 1.2.1 - Missing Authorization4.3<= 1.5.81.5.9462
14 Dec 2022Appsero <= 1.2.0 - Cross-Site Request Forgery4.3<= 1.5.81.5.9464

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP CTA
4 May 2026219
11 May 2026436
18 May 2026344
25 May 2026205
1 Jun 2026170
8 Jun 2026162
15 Jun 2026128
22 Jun 2026119
29 Jun 2026145
6 Jul 2026224
13 Jul 2026297
20 Jul 2026147
27 Jul 2026145
3 Aug 2026164
10 Aug 2026135
17 Aug 2026167
24 Aug 2026133
31 Aug 2026168
7 Sep 2026150
14 Sep 2026168
21 Sep 2026153
28 Sep 2026265
5 Oct 2026147
12 Oct 2026174
19 Oct 2026249
26 Oct 2026229
2 Nov 202637

Weekly downloads over the last 4 weeks are 8% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Simple Chat ButtonScore 100 · 40,000+ButtonizerScore 100 · 40,000+Chat Button & Custom ChatGPT-Powered BotScore 100 · 20,000+GoftinoScore 100 · 10,000+CrispScore 100 · 10,000+

Facts

Version2.3.0
AuthorBlend Media
Added14 Jun 2020
Last updated6 May 2026
Active installs2,000+
Requires WordPress5.0
Tested up to6.9.11
Requires PHP7.4
CategoryMarketing & Advertising > Pop-ups & Lead Generation
Tagscta, call button, sticky button, call to action, call now button

Other plugins by this author: EZ Countdown Timer, Freshtag - Last Modified Info & Timestamp, Detect Old Content, Boost SEO, Server Info for Debugging, Buzzbar - Announcement Bar, Promo Bar & Notification Banner

Questions

Is WP CTA still maintained?

Yes. Last release 6 May 2026, 16 releases in the last 24 months.

Who owns WP CTA, and has it changed hands?

No change recorded. Main committer blendmedia since Jun 2020.

Was WP CTA removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP CTA safe?

8 known vulnerabilities, all fixed (latest in 2.1.3). Not on the exploited list.

Is the latest WP CTA update safe to install?

No ownership change before 2.3.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue