The Like-it WordPress plugin versions up to and including 2.2 are vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in the likeit_conf() function. This vulnerability allows unauthenticated attackers to trick site administrators into performing actions that update plugin settings or inject malicious scripts via forged requests.