The Like‑it WordPress plugin suffers from a missing nonce check in the likeit_conf() handler, enabling a Cross‑Site Request Forgery that lets an unauthenticated attacker change plugin settings and inject a malicious script that is stored for later display. The attack, identified as CWE‑352, effectively gives the attacker the ability to execute arbitrary JavaScript in the context of the site’s visitors when the destroyed settings are rendered, allowing defacement, credential theft, or further exploitation of the host. This flaw is present in every version of Like‑it up to and including 2.2, affecting WordPress sites that have installed or upgraded to these releases. The plugin is maintained by nikolayyordanov and can be identified in the WordPress plugin base, with the vulnerable function located in like‑it.php around line 130–131 as noted in the plugin source. The risk profile reflects a medium CVSS score of 6.1, but the EPSS score of <1 % suggests that widespread exploitation is unlikely at the moment, and the issue is not currently listed in CISA’s KEV database. Nevertheless, the administrative interface must be used carefully: an attacker must trick a site administrator into clicking a crafted link or form submission, after which the CSRF bypass permits the settings overwrite and insertion of a persistent XSS payload. The exploit does not require credentials and has no direct impact on the WordPress core, but it does open the site to arbitrary JavaScript execution by anyone viewing the affected settings.

WordPress installations running the Like‑it plugin version 2.2 or older. The plugin, developed by nikolayyordanov, is available in the WordPress plugin repository. Administrators of sites hosting any of these releases are at risk.

Due to the missing nonce validation, an attacker can form a request to the likeit_conf() endpoint and, using a link that an admin might click, change configuration settings and persist a malicious script. The exploit relies on social engineering to get the administrator to trigger the request; it does not require any authentication or advanced privilege. The CVSS score of 6.1 indicates a medium severity, and the EPSS of <1 % indicates low probability of large‑scale exploitation, but the flaw is public and could be used for targeted attacks.