Description
The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2025-12-12
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross-Site Scripting
Action: Update Plugin
AI Analysis

Impact

The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross‑Site Scripting due to the use of the unescaped $SERVER['PHP_SELF'] variable. A malicious user can inject arbitrary JavaScript into a page that is displayed when another user follows a crafted link. This allows the attacker to execute code in the victim’s browser, which can lead to theft of session cookies, defacement of the site, or malicious redirects, thereby compromising the confidentiality and integrity of user data.

Affected Systems

All installations of the Like DisLike Voting plugin from vendor wasiul99 that use version 1.0.1 or earlier are affected. This includes any WordPress site that has not upgraded beyond these releases.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1 % suggests a low probability of automated exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger it remotely by tricking a user into visiting a specially crafted URL; no authentication or elevated privileges are required. The impact is limited to the surface area of the victim’s browser session, but widespread, unsanitized cross‑site scripting can disrupt user experience and erode trust.

Generated by OpenCVE AI on April 22, 2026 at 16:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Like DisLike Voting plugin to the latest release that removes the use of $SERVER['PHP_SELF'] or applies proper output escaping.
  • If an update is not possible, immediately disable or uninstall the plugin to eliminate the malicious input vector.
  • As a temporary measure, apply input validation to sanitize $SERVER['PHP_SELF'] or implement a custom filter that encodes the value before output, and consider adding a web‑application‑firewall rule to block common reflected XSS payloads.

Generated by OpenCVE AI on April 22, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 15 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 12 Dec 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 12 Dec 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:42:30.399Z

Reserved: 2025-12-05T17:01:22.711Z

Link: CVE-2025-14129

cve-icon Vulnrichment

Updated: 2025-12-15T18:07:37.959Z

cve-icon NVD

Status : Deferred

Published: 2025-12-12T04:15:47.553

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-14129

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T16:15:21Z

Weaknesses