Stored Cross-Site Scripting in LikeBtn Plugin for WordPress

CVE-2026-116552

What is CVE-2026-116552?

The Like Button Rating ♥ LikeBtn plugin for WordPress is susceptible to Stored Cross-Site Scripting because of a lack of rigorous input validation and output encoding in the 'HTTP_CLIENT_IP' parameter across all versions up to 2.6.64. This vulnerability allows unauthenticated attackers to inject malicious web scripts into pages, which are executed when a user accesses the compromised page. For successful exploitation, it is critical that the site administrator has turned off the 'Be GDPR compliant' option, as this would normally hash stored IP addresses and mitigate potential attacks. Additionally, the attacker must prompt an action from the administrator, as they cannot exploit this flaw independently.

References