Stored Cross-Site Scripting Vulnerability in WP ULike Plugin for WordPress

CVE-2026-2358

What is CVE-2026-2358?

The WP ULike plugin for WordPress has a security flaw that allows authenticated users with Contributor-level access and above to exploit a Stored Cross-Site Scripting vulnerability. This is achieved through the [wp_ulike_likers_box] shortcode's template attribute, where improper sanitization following the html_entity_decode() function permits the execution of injected scripts whenever a user views a page with at least one like. This poses a significant risk, as harmful scripts can execute within the context of user sessions, compromising site security and user safety.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References