Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Mar 11, 2026WP ULike: Stored Cross-Site ScriptingCVE-2026-2358 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[wp_ulike_likers_box]` shortcode `template` attribute in all versions up to, and including, 5.0.1. This is due to the use of `html_entity_decode()` on shortcode attributes without subsequent output sanitization, which effectively bypasses WordPress's `wp_kses_post()` content filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The post must have at least one like for the XSS to render.
- Product
- WP ULike
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update WP ULike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 2, 2026WP ULike: Insecure Direct Object ReferenceCVE-2026-0909 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the `wp_ulike_delete_history_api` AJAX action not verifying that the log entry being deleted belongs to the current user. This makes it possible for authenticated attackers, with Subscriber-level access and above (granted the 'stats' capability is assigned to their role), to delete arbitrary log entries belonging to other users via the 'id' parameter.
- Product
- WP ULike
- Affected
- up to 4.8.3.1
- What to do
- Affects up to 4.8.3.1. Update WP ULike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2025WP ULike Pro: Arbitrary file uploadsCVE-2024-9648 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to upload limited arbitrary files like .php2, .php6, .php7, .phps, .pht, .phtm, .pgif, .shtml, .phar, .inc, .hphp, .ctp, .module, .html, .svg on the affected site's server which may make make other attacks like Cross-Site Scripting possible. Only versions up to 1.8.7 were confirmed vulnerable, however, the earliest tested version for a patch we have access to is 1.9.4, so we are considering 1.9.4 the patched version.
- Product
- WP ULike Pro
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update WP ULike Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpulike.comwordfence.com
May 15, 2025WP ULike: Does not sanitise and escape some of its settingsCVE-2024-12770 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ULike
- Fixed in
- 4.7.6
- What to do
- Update WP ULike to 4.7.6 or newer.
Apr 10, 2025WP ULike: Missing AuthorizationCVE-2025-32259 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alimir WP ULike wp-ulike.This issue affects WP ULike: from n/a through <= 4.7.9.1.
- Product
- WP ULike
- Affected
- up to 4.7.9.1
- What to do
- Affects up to 4.7.9.1. Update WP ULike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025WP ULike: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22738 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alimir WP ULike wp-ulike allows Stored XSS.This issue affects WP ULike: from n/a through <= 4.7.6.
- Product
- WP ULike
- Affected
- up to 4.7.6
- What to do
- Affects up to 4.7.6. Update WP ULike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-7879 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP ULike
- Fixed in
- 4.7.5
- What to do
- Update WP ULike to 4.7.5 or newer.
Oct 15, 2024WP ULike – The Ultimate Engagement Toolkit for Websites: Cross-Site Request ForgeryCVE-2024-9649 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7.4. This is due to missing or incorrect nonce validation on the wp_ulike_delete_history_api() function. This makes it possible for unauthenticated attackers to delete engagements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP ULike – The Ultimate Engagement Toolkit for Websites
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update WP ULike – The Ultimate Engagement Toolkit for Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 25, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-7878 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ULike
- Fixed in
- 4.7.4
- What to do
- Update WP ULike to 4.7.4 or newer.
Sep 6, 2024WP ULike: Does not properly sanitize user display namesCVE-2024-6792 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.
- Product
- WP ULike
- Fixed in
- 4.7.2.1
- What to do
- Update WP ULike to 4.7.2.1 or newer.
Jul 24, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-6094 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ULike
- Fixed in
- 4.7.1
- What to do
- Update WP ULike to 4.7.1 or newer.
May 2, 2024WP ULike – Most Advanced WordPress Marketing Toolkit: SQL InjectionCVE-2024-1797 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to SQL Injection via the 'status' and 'id' attributes of the 'wp_ulike_counter' and 'wp_ulike' shortcodes in all versions up to, and including, 4.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP ULike – Most Advanced WordPress Marketing Toolkit
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update WP ULike – Most Advanced WordPress Marketing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024WP ULike – Most Advanced WordPress Marketing Toolkit: Stored Cross-Site ScriptingCVE-2024-1759 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP ULike – Most Advanced WordPress Marketing Toolkit
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update WP ULike – Most Advanced WordPress Marketing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024WP ULike: Stored Cross-Site ScriptingCVE-2024-1572 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_ulike' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on the user supplied 'wrapper_class' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP ULike
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update WP ULike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.