Call Now Button – The Free Click to Call Button for WordPress
Call Now Button – The Free Click to Call Button for WordPress has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 4.7, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 5 issues recorded for Call Now Button – The Free Click to Call Button for WordPress has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. Call Now Button – The Free Click to Call Button for WordPress is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-1455Call Now Button <= 1.1.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

Call Now Button – The Free Click to Call Button for WordPress
Author
Jerry Rietveld
Call Now Button puts a floating call button on your website. On a phone, one tap starts the call. On a desktop, it’s a standard click-to-call link that opens in the visitor’s calling app. Either way, nobody has to hunt for your contact page or copy a number by hand. It has been doing exactly that since 2013, on more than 200,000 websites. Set it up in under a minute Install, enable the button, type your phone number, save. There is no account to create, no code to paste, and nothing more to configure before it works. From there you can make it yours: Label it: Leave the label empty for a clean, circular phone button or add text. The text can sit in a bar across the top or bottom of the screen or in a bubble beside the round button. Color it: Pick your own button and icon colors. Place it: Choose from 8 preset screen positions or spread the button across the full width of the top or bottom of the screen. Size it: Use one slider to set the button size and another to place the button behind other page elements when something else, such as a cookie notice, needs to sit on top. Show it where it belongs: Enter post and page IDs to show the button only on those pages or to exclude those pages. Show it to the right devices: Choose mobile only, desktop only, or both. Measure it: Send clicks to Google Analytics or fire a Google Ads conversion tag so that a call counts as a conversion. Using Google Tag Manager instead? There’s a guide for that. All of the above is free and works without an account. What you get, by plan Free: plugin only, no account One call button Labels, colors, all 8 positions, button size, layering Google Analytics click tracking and Google Ads conversion tracking Include or exclude specific posts and pages Mobile, desktop, or both Free with a NowButtons account Everything above, plus: Up to 5 buttons, with one visible per page (showing multiple buttons on the same page requires PRO) More actions: SMS/Text, Email, Maps, Links, Scroll to point Chat and social actions: WhatsApp, Messenger, Telegram, Signal, Zalo, Viber, Line, WeChat More advanced display rules for deciding where buttons appear Live preview while you edit PRO: paid, with a 14-day free trial Everything above, plus: Up to 100 buttons, and more than one button on the same page Multi-action buttons: Buttonbar (up to 5 actions), Multibutton, Button Dots, Button Flower WhatsApp chat window and Messenger chat widget Live chat (beta) Slide-in content windows, iframe embedding and form embedding Intercom chat integration A weekly scheduler that controls when each button appears Geo targeting: include or exclude countries Icon picker, custom images on buttons, button animations Appear after scrolling The account and PRO features are set up inside your WordPress dashboard. No need to leave the plugin to use them. Our cloud service: NowButtons.com The account and PRO features above are powered by our cloud service NowButtons. The plugin does not contact our servers at all until you choose to connect it. The button your visitors see is rendered entirely by your own site. It makes no external requests, fetches nothing from us and performs no tracking beyond the Google Analytics or Google Ads tags you configure yourself. When you do connect, the plugin sends an email address and your domain to our servers to create your account, and your button configuration is then stored on and served from our servers. Requests identify your WordPress and PHP version and your site URL. Terms & Conditions: https://nowbuttons.com/legal/terms/ Privacy statement: https://nowbuttons.com/legal/privacy/ Separately, the plugin can send anonymous error reports and usage statistics to help us fix bugs. This is off by default and only starts if you switch on “Errors and usage” under Settings. It is never enabled on your visitors’ pages. More about our cloud service at NowButtons.com.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C