CVE-2026-2358

Name of the Vulnerable Software and Affected Versions WP ULike versions up to and including 5.0.1

Description The WP ULike plugin for WordPress is susceptible to Stored Cross-Site Scripting through the [wp ulike likers box] shortcode template attribute. This occurs because html entity decode() is used on shortcode attributes without proper output sanitization, bypassing WordPress’s wp kses post() content filtering. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the affected page, but only if the post has at least one like. The vulnerable parameter is template.

Recommendations Update WP ULike to a version newer than 5.0.1.