Likebtn
Monthly
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) lets unauthenticated remote attackers place arbitrary script in the Client-IP header value, which the plugin stores without sanitization and renders without escaping in its admin-side votes/IP view; the payload runs when an administrator later opens that page. Two stacked prerequisites sharply limit real-world exposure: the site owner must have turned off the plugin's default 'Be GDPR compliant' setting (while enabled, stored IPs are hashed and the payload is neutralized), and the attacker cannot trigger execution themselves because it depends on an administrator visiting the injected page. No public exploit has been identified at time of analysis, and the issue is assessed as this-month priority rather than urgent; the vendor changeset shows a fix in version 2.6.65.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.6.53. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) lets unauthenticated remote attackers place arbitrary script in the Client-IP header value, which the plugin stores without sanitization and renders without escaping in its admin-side votes/IP view; the payload runs when an administrator later opens that page. Two stacked prerequisites sharply limit real-world exposure: the site owner must have turned off the plugin's default 'Be GDPR compliant' setting (while enabled, stored IPs are hashed and the payload is neutralized), and the attacker cannot trigger execution themselves because it depends on an administrator visiting the injected page. No public exploit has been identified at time of analysis, and the issue is assessed as this-month priority rather than urgent; the vendor changeset shows a fix in version 2.6.65.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LikeBtn Like Button Rating likebtn-like-button.6.53. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.