Like Button Rating Likebtn
Monthly
Stored cross-site scripting in the Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) lets unauthenticated remote attackers place arbitrary script in the Client-IP header value, which the plugin stores without sanitization and renders without escaping in its admin-side votes/IP view; the payload runs when an administrator later opens that page. Two stacked prerequisites sharply limit real-world exposure: the site owner must have turned off the plugin's default 'Be GDPR compliant' setting (while enabled, stored IPs are hashed and the payload is neutralized), and the attacker cannot trigger execution themselves because it depends on an administrator visiting the injected page. No public exploit has been identified at time of analysis, and the issue is assessed as this-month priority rather than urgent; the vendor changeset shows a fix in version 2.6.65.
Stored cross-site scripting in the Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) lets unauthenticated remote attackers place arbitrary script in the Client-IP header value, which the plugin stores without sanitization and renders without escaping in its admin-side votes/IP view; the payload runs when an administrator later opens that page. Two stacked prerequisites sharply limit real-world exposure: the site owner must have turned off the plugin's default 'Be GDPR compliant' setting (while enabled, stored IPs are hashed and the payload is neutralized), and the attacker cannot trigger execution themselves because it depends on an administrator visiting the injected page. No public exploit has been identified at time of analysis, and the issue is assessed as this-month priority rather than urgent; the vendor changeset shows a fix in version 2.6.65.