← WordPress Vulnerabilities
WordPress security by component

WP ULike

WP ULike is a WordPress component with 15 published CVE records in this archive. The latest tracked vulnerability was published Mar 11, 2026; the highest CVE/CNA score is 8.8.

Plugin slug: wp-ulike

CVE-2026-2358: WP ULike: Cross-site scripting

WP ULike is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PublishedMar 11, 2026
Safe version guidanceSee mitigation notes
Safe version
Mar 11, 2026 CVE-2026-2358
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVDPending
Feb 03, 2026 CVE-2026-0909
WP ULike: A security weakness
WP ULike is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
May 15, 2025 CVE-2024-12770
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
Apr 10, 2025 CVE-2025-32259
WP ULike: A security weakness
WP ULike is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Jan 15, 2025 CVE-2025-22738
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.9
NVD4.8
Nov 06, 2024 CVE-2024-7879
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
Oct 16, 2024 CVE-2024-9649
WP ULike – The Ultimate Engagement Toolkit for Websites: Cross-site request forgery
WP ULike – The Ultimate Engagement Toolkit for Websites is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVDPending
Sep 25, 2024 CVE-2024-7878
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVD4.8
Sep 06, 2024 CVE-2024-6792
WP ULike: A security weakness
WP ULike is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE3.5
NVDPending
Jul 24, 2024 CVE-2024-6094
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVD4.8
May 02, 2024 CVE-2024-1797
WP ULike – Most Advanced WordPress Marketing Toolkit: SQL injection
WP ULike – Most Advanced WordPress Marketing Toolkit is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE8.8
NVDPending
May 02, 2024 CVE-2024-1759
WP ULike – Most Advanced WordPress Marketing Toolkit: Cross-site scripting
WP ULike – Most Advanced WordPress Marketing Toolkit is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
May 02, 2024 CVE-2024-1572
WP ULike: Cross-site scripting
WP ULike is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
Oct 25, 2023 CVE-2023-45640
Wp Ulike: Cross-site scripting
Wp Ulike is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVD5.4
Nov 30, 2022 CVE-2022-45842
Wp Ulike: A security weakness
Wp Ulike is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVD3.7