Like Button Rating
Monthly
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.6.53. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.6.53. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.