The Post Like Dislike plugin contains a reflected Cross‑Site Scripting flaw that allows an attacker to inject malicious JavaScript into pages served by the plugin. The flaw originates from unsanitized and unescaped use of the $_SERVER['PHP_SELF'] variable. When a crafted URL containing a payload is visited, the script is executed in the victim's browser, enabling attackers to steal session data, deface content, or perform phishing attacks. This vulnerability is classified as CWE‑79.

The vulnerability affects the WordPress plugin "Post Like Dislike" from vendor cuvixsystem. All released versions up to and including 1.0 are impacted; newer releases beyond 1.0 are presumed patched. Sites running the plugin are at risk regardless of user privileges, since unauthenticated users can trigger the XSS by visiting a malicious link.

The CVSS base score is 6.1, indicating a medium level of severity. The exploit probability according to EPSS is below 1 %, suggesting that the flaw is rarely targeted in the wild. It is not listed in CISA’s KEV catalog. Successful exploitation requires an attacker to embed a malicious script into a URL that the victim follows, which typically demands social‑engineering or a malicious advertisement. Because the vulnerability is reflected, no local state is altered and the impact is limited to the victim’s browser session.