A CSRF flaw in the WP likes plugin also permits reflected XSS, allowing an attacker to forge requests on behalf of authenticated users and inject script via URLs that echo back, compromising user sessions; this weakness is identified as CWE‑352.

The WordPress WP likes plugin developed by aakash1911 is affected; all released versions up to and including 3.1.1 are vulnerable. Sites using this plugin on WordPress are at risk.

The CVSS score of 7.1 indicates moderate‑to‑high severity, while an EPSS score of < 1% suggests low current exploitation probability, and the vulnerability is not in the CISA KEV catalog. However, because any authenticated user on a site running WP likes <=3.1.1 can be abused via crafted links or forms, the potential damage is significant; the likely attack vector is a simple HTTP request or link embedded in a website, email, or social media post, requiring only access to the vulnerable plugin but not administrative privileges.