WordPress Security Bulletin: WP ULike Plugin Vulnerability (CVE-2026-2358)

Security Alert Summary

The WP ULike plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the [wp_ulike_likers_box] shortcode template attribute in all versions up to and including 5.0.1. The issue is caused by use of html_entity_decode() on shortcode attributes without subsequent output sanitization, which bypasses wp_kses_post(). Authenticated users with Contributor-level access and above can inject scripts that execute when a page with an affected post (with at least one like) is viewed.

CVE Details

• CVE ID: CVE-2026-2358
• Affected component: WP ULike plugin for WordPress
• Affected versions: All versions up to and including 5.0.1 (as stated in the CVE entry)
• Published: March 11, 2026 at 6:17:14 AM UTC
• Last modified: March 11, 2026 at 1:52:47 PM UTC
• Vulnerability status: Awaiting Analysis
• CVSS v3.1: Base Score: 6.4 — Severity: MEDIUM
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW (authenticated contributor-level and above)
  • User Interaction: NONE
  • Scope: CHANGED
• Primary impact:
  • Confidentiality: LOW
  • Integrity: LOW
  • Availability: NONE
• CWE / weakness: CWE-79 (Cross-site Scripting)

Technical Details

The vulnerability exists in handling of the template attribute for the [wp_ulike_likers_box] shortcode. The plugin calls html_entity_decode() on shortcode attributes and does not apply output sanitization afterward, which effectively bypasses WordPress content filtering provided by wp_kses_post(). As a result, an authenticated user with Contributor-level privileges or higher can store arbitrary script content via the shortcode attribute. When a page containing a post with at least one like is viewed, that stored script can execute in the context of visitors’ browsers.

The description identifies the specific shortcode attribute and the problematic use of html_entity_decode(); no alternate endpoints or other functions beyond those named are described in the CVE entry. The impact is stored XSS limited to contexts where the likers box is rendered for posts that meet the stated condition (post must have at least one like).

How This Could Impact Your Website

Consider a small editorial site with multiple user types: the site owner, internal editors, and external contributors. If a contributor adds or edits content using the affected shortcode and includes a crafted template attribute, the injected script could execute when other users (including editors and site visitors) view the affected page. Practical consequences include exposure of session-bound data accessible to scripts in the page context, and increased risk of targeted phishing or social engineering if internal user information is exposed or can be inferred.

The described impact aligns with low confidentiality and integrity impacts rather than full site takeover, but it can still enable targeted attacks against staff or users. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

• Update the affected plugin as soon as a patched version is available (the CVE entry does not specify a fixed version).
• Review and reduce unnecessary user roles, especially Contributor-level accounts with publishing or shortcode access.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins from the site.
• Monitor site activity and logs for unusual behavior or unexpected content changes in posts and shortcodes.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://github.com/Alimir/wp-ulike/commit/3dcce696ea251b3733448332cc167e03b2a17c12
• https://plugins.trac.wordpress.org/browser/wp-ulike/trunk/includes/functions/general.php#L375
• https://plugins.trac.wordpress.org/browser/wp-ulike/trunk/includes/functions/utilities.php#L226
• https://plugins.trac.wordpress.org/browser/wp-ulike/trunk/includes/functions/utilities.php#L251
• https://plugins.trac.wordpress.org/browser/wp-ulike/trunk/includes/hooks/shortcodes.php#L209
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475381%40wp-ulike%2Ftrunk&old=3457255%40wp-ulike%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/74a7db23-f91c-452b-bc24-58fda69caf17?source=cve