Description
The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which would otherwise hash stored IP values and neutralize the payload. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Published: 2026-10-30
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: Stored cross‑site scripting (XSS)
Action: Patch
AI Analysis

Impact

The Like Button Rating ♥ LikeBtn WordPress plugin permits unauthenticated attackers to insert arbitrary JavaScript into the database via the 'Client-IP' HTTP header when the site administrator has disabled the 'Be GDPR compliant' option. The unsanitized header value is stored without escaping, so any visitor who loads a page containing the stored IP will execute the injected code. This stored cross‑site scripting vulnerability (CWE‑79) can lead to session hijacking, defacement, or delivery of malware.

Affected Systems

All installations of the Like Button Rating ♥ LikeBtn plugin for WordPress up to and including version 2.6.64 are vulnerable. Earlier releases and the patched 2.6.65 and newer versions are not affected.

Risk and Exploitability

With a CVSS score of 4.7 the flaw is considered medium severity, and no EPSS data is available. Because a successful attack depends on the administrator disabling the 'Be GDPR compliant' setting, exploitation is limited to sites misconfigured in that way. The vulnerability is not listed in the CISA KEV catalog, indicating it is not presently known to be actively exploited.

Generated by OpenCVE AI on October 30, 2026 at 18:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Like Button Rating plugin to version 2.6.65 or later, where the header value is sanitized and the GDPR compliance option is enforced.
  • If an upgrade cannot be performed immediately, re‑enable the 'Be GDPR compliant' option so that stored IP values are hashed and cannot contain malicious payloads.
  • Inspect and harden the application and server configuration to prevent any unsanitized header values (such as 'Client-IP') from being stored or rendered without proper validation and output escaping.

Generated by OpenCVE AI on October 30, 2026 at 18:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which would otherwise hash stored IP values and neutralize the payload. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Title Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-30T17:26:01.617Z

Reserved: 2026-10-26T14:42:58.817Z

Link: CVE-2026-116552

cve-icon Vulnrichment

Updated: 2026-10-30T17:25:58.019Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T18:17:23.727

Modified: 2026-10-30T18:33:26.087

Link: CVE-2026-116552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T18:45:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')