The WP ULike plugin for WordPress versions up to and including 4.6.9 contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'wrapper_class' attribute of the 'wp_ulike' shortcode. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The vulnerability does not require user interaction once the malicious content is stored and viewed. The CVSS vector indicates network attack vector, low attack complexity, privileges required at the level of a contributor, no user interaction needed, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed on behalf of users viewing the page, theft of sensitive information accessible to the victim, and potential compromise of user sessions. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the WP ULike plugin if feasible. Monitor official vendor channels for updates and apply any official fixes promptly once released.