Key detail from vendor description: the WP ULike plugin for WordPress contains a stored cross‑site scripting vulnerability in the `[wp_ulike_likers_box]` shortcode `template` attribute. The plugin applies `html_entity_decode()` to shortcode attributes without performing subsequent output sanitization, effectively bypassing WordPress’s default `wp_kses_post()` content filtering. This flaw allows authenticated attackers with Contributor‑level access or higher to inject arbitrary JavaScript that will run whenever a page containing a post with at least one like is viewed by any user, directly affecting confidentiality, integrity, and availability of the site’s front‑end.

The vulnerability affects all installations of the WP ULike plugin from vendor alimir, specifically all versions up to and including 5.0.1. WordPress sites that have the plugin activated and employ the `[wp_ulike_likers_box]` shortcode in any page or post are at risk.

The CVSS score for this issue is 6.4, indicating medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires that the attacker is an authenticated user with Contributor or higher privileges, and the payload will only execute if the target page contains a post that has at least one like. Consequently, the risk is primarily internal or from compromised contributor accounts, and the potential impact is significant only if such an account is accessible to malicious actors.