The WP ULike plugin for WordPress up to version 5.0.1 is vulnerable to stored cross-site scripting (CWE-79) via the `template` attribute of the `[wp_ulike_likers_box]` shortcode. This occurs because the plugin applies `html_entity_decode()` to shortcode attributes but fails to sanitize the output properly, effectively bypassing WordPress's `wp_kses_post()` filtering. As a result, authenticated users with Contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the affected pages, contingent on the post having at least one like. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact without availability impact. There is no indication of known exploits in the wild or an official patch available at this time.

An attacker with Contributor-level or higher privileges can inject persistent malicious scripts into WordPress pages using the vulnerable shortcode attribute. These scripts execute in the browsers of users who visit the affected pages, potentially leading to partial confidentiality and integrity compromise. The vulnerability requires the post to have at least one like for the XSS payload to trigger. There is no direct impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the WP ULike plugin if feasible. Monitor for updates from the plugin vendor or WordPress security advisories to apply any forthcoming patches promptly.