SZB-f06edd1f82
Like Button Rating LikeBtn WordPress plugin XSS listed as EUVD-2026-114216
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- LikeBtn
- Product
- Like Button Rating ♥ LikeBtn
- First seen
Summary
The EUVD listing (CVSS v3.1 score 4.7) describes a stored cross-site scripting flaw in the Like Button Rating LikeBtn WordPress plugin, affecting all versions up to and including 2.6.64. The listing does not name a CVE ID and the item does not indicate that a fix is available.
If you use LikeBtn
Check whether the LikeBtn plugin is installed and which version is running
Update to a patched release once the vendor publishes one
Review stored rating or comment data for injected scripts
What the sources say 1
· Mastodon: “The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitizatio...” Source