Plugin icon

WP ULike – Like & Dislike Buttons for Engagement and Feedback

wp-ulike

Vulnerabilities:

16

Last Updated:

April 26, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-03-10
Title
WP ULike < 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
Fixed in
Fixed in 5.0.2
CVSS
5.5 (medium)
Published
2026-02-02
Title
WP ULike < 5.0.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter
Fixed in
Fixed in 5.0.0
CVSS
5.3 (medium)
Published
2025-04-04
Title
WP ULike < 4.7.10 - Missing Authorization to Unauthenticated Content Spoofing
Fixed in
Fixed in 4.7.10
CVSS
5.3 (medium)
Published
2025-01-14
Title
WP ULike < 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.7.7
CVSS
4.4 (medium)
Published
2024-11-19
Title
WP ULike < 4.7.6 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.6
CVSS
3.5 (low)
Published
2024-10-16
Title
WP ULike < 4.7.5 - Admin+ Stored XSS via Widgets
Fixed in
Fixed in 4.7.5
CVSS
3.5 (low)
Published
2024-10-15
Title
WP ULike < 4.7.5 - Cross-Site Request Forgery to Statistic Deletion
Fixed in
Fixed in 4.7.5
CVSS
4.3 (medium)
Published
2024-09-04
Title
WP ULike < 4.7.4 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.4
CVSS
3.5 (low)
Published
2024-08-16
Title
WP ULike < 4.7.2.1 - Subscriber+ Stored-XSS
Fixed in
Fixed in 4.7.2.1
CVSS
8.0 (high)
Published
2024-07-03
Title
WP ULike < 4.7.1 - Admin+ Stored XSS
Fixed in
Fixed in 4.7.1
CVSS
3.5 (low)
Published
2024-04-26
Title
WP ULike – Most Advanced WordPress Marketing Toolkit < 4.7.0 - Authenticated (Contributor+) SQL Injection via Shortcodes
Fixed in
Fixed in 4.7.0
CVSS
8.8 (high)
Published
2024-04-26
Title
WP ULike < 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 4.7.0
CVSS
6.4 (medium)
Published
2024-04-26
Title
WP ULike < 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.7.0
CVSS
6.4 (medium)
Published
2023-10-12
Title
WP ULike < 4.6.9 - Contributor+ Stored Cross Site Scripting via Shortcode
Fixed in
Fixed in 4.6.9
CVSS
5.9 (medium)
Published
2022-11-24
Title
WP ULike < 4.6.5 - Unauthenticated Rating Tampering via Race Condition
Fixed in
Fixed in 4.6.5
CVSS
3.7 (low)
Published
2018-05-14
Title
WP ULike <= 3.1 - Unauthenticated Stored XSS
Fixed in
Fixed in 3.2
CVSS
n/a