Threats tagged 'ghsa-4v84-f6r5-m2gf'

The Like Button Rating ♥ LikeBtn plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the HTTP_CLIENT_IP header parameter. This affects all versions up to and including 2.6.64. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which normally hashes IP addresses to prevent payload execution. Additionally, an administrator action is necessary to trigger the vulnerability, as attackers cannot exploit it independently.