The Like & Share My Site plugin for WordPress is vulnerable to a cross‑site request forgery that allows an unauthenticated attacker to submit a forged request to the plugin’s admin page. Because the nonce validation is missing or incorrect, the attacker can change the plugin’s settings and inject malicious JavaScript. When site visitors load the affected page, the injected script runs in their browsers, producing a stored cross‑site scripting event that can be used to steal credentials, deface content, or redirect users to malicious sites.

All installations of the Like & Share My Site plugin running any version up to and including 0.2 are affected. Site owners should identify whether their current installation is in this range and plan a remediation or removal accordingly. Versions released after 0.2 are not mentioned in the CVE data, so the presence of a fix in later releases is uncertain.

The CVSS score of 6.1 classifies the vulnerability as medium severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. An attacker would need to entice a site administrator to click a crafted link or otherwise trigger the forged request. Once the script is persisted, any visitor to the affected page could be compromised.