The WP ULike – Like & Dislike Buttons for Engagement and Feedback WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user input during web page generation. Authenticated users with subscriber-level privileges or higher can inject arbitrary JavaScript code via their display name. This malicious code executes in the context of other users viewing the injected pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to and including 4.6.9. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

Successful exploitation allows an authenticated user to inject persistent malicious scripts that execute in other users' browsers when they visit affected pages. This can lead to partial confidentiality and integrity loss, such as theft of session tokens or unauthorized actions performed on behalf of users. There is no impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting subscriber-level user input or display name changes, and apply web application firewall (WAF) rules to detect and block suspicious script injections related to user display names. Monitor vendor channels for updates and apply patches promptly once released.