PT-2026-24577 · Alimir+1 · Wp Ulike – Like & Dislike Buttons For Engagement/Feedback+1
Quốc Huy
·
Published
2026-03-11
·
Updated
2026-03-15
·
CVE-2026-2358
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WP ULike versions up to and including 5.0.1
Description
The WP ULike plugin for WordPress is susceptible to Stored Cross-Site Scripting through the
[wp ulike likers box] shortcode template attribute. This occurs because html entity decode() is used on shortcode attributes without proper output sanitization, bypassing WordPress’s wp kses post() content filtering. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the affected page, but only if the post has at least one like. The vulnerable parameter is template.Recommendations
Update WP ULike to a version newer than 5.0.1.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp Ulike – Like & Dislike Buttons For Engagement/Feedback
Wp Ulike