Stored Cross‑Site Scripting occurs when user‑controlled data is rendered without proper encoding. In WP ULike, the plugin fails to neutralize input, allowing an attacker to inject arbitrary scripts into pages served to other users. Successful exploitation can lead to cookie theft, session hijacking, defacement, or the delivery of malware, compromising confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is a stored XSS, categorized under CWE‑79.

Alimir’s WP ULike plugin for WordPress versions up to and including 4.7.6 is affected. The issue exists in all releases from the earliest available version up to 4.7.6, meaning a broad range of installations remain vulnerable until an upgrade is performed. The plugin is a popular WordPress interaction tool, so many sites may be impacted.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of <1% suggests low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Likely attack requires access to the plugin’s content creation or moderation interface, enabling a user with authority to submit malicious input that is subsequently stored and rendered. Because the XSS is stored, it can affect all users who view the affected content. Based on the description, it is inferred that an attacker needs the ability to create or edit content within the plugin’s interface to inject malicious code.