WP ULike – Like Buttons, Voting & Engagement Analytics

WP ULike – Like Buttons, Voting & Engagement Analytics has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; all 17 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 11 of the records (65%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 17 issues recorded for WP ULike – Like Buttons, Voting & Engagement Analytics has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (3) reported by Dmitrii Ignatyev. WP ULike – Like Buttons, Voting & Engagement Analytics is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

01234567891028.08.2014Today14.05.20187.5WP ULike < 3.2 - Missing Authorization CVSS 7.5 · 14.05.20187.2WP ULike < 3.2 - Cross-Site Scripting CVSS 7.2 · 14.05.201824.11.20224.3WP ULike <= 4.6.4 - Race Condition CVSS 4.3 · 24.11.202212.10.20236.4WP ULike <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode CVSS 6.4 · 12.10.202326.04.20246.4WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 26.04.20248.8WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes CVSS 8.8 · 26.04.20246.4WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 26.04.202403.07.20244.4WP ULike <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 03.07.202416.08.20246.4WP ULike 4.7.1 - 4.7.2 - Authenticated (Subscriber+) Stored-Cross-Site Scripting CVSS 6.4 · 16.08.202404.09.20244.4WP ULike <= 4.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 04.09.202415.10.20244.4WP ULike <= 4.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 15.10.20244.3WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion CVSS 4.3 · 15.10.202414.01.20254.4WP ULike <= 4.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 14.01.202523.01.20254.4WP ULike <= 4.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 23.01.202504.04.20255.3WP ULike <= 4.7.9.1 - Missing Authorization to Unauthenticated Content Spoofing CVSS 5.3 · 04.04.202502.02.20265.3WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter CVSS 5.3 · 02.02.202610.03.20266.4WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute CVSS 6.4 · 10.03.2026

Strategic Overview

Avg CVSSMedium
5.7/ 10
Patch Coverage100%
Open

0

Fixed

17

Get automatic notifications for all WP ULike – Like Buttons, Voting & Engagement Analytics vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-1797

WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes

Read the full analysis

Vulnerability Records

17 records
2026-03-10 17:08CVE-2026-2358
6.4
Medium
Quốc Huy (jtwings)Yes
2026-02-02 14:51CVE-2026-0909
5.3
Medium
Pouria Shahba (p0or1ya)Yes
2025-04-04 00:00CVE-2025-32259
5.3
Medium
Robert DeVoreYes
2025-01-23 00:00CVE-2024-12770
4.4
Medium
Dmitrii IgnatyevYes
2025-01-14 00:00CVE-2025-22738
4.4
Medium
Robert DeVoreYes
2024-10-15 00:00CVE-2024-7879
4.4
Medium
Dmitrii IgnatyevYes
2024-10-15 00:00CVE-2024-9649
4.3
Medium
Bilal Chawich (Duke)Yes
2024-09-04 00:00CVE-2024-7878
4.4
Medium
Bob MatyasYes
2024-08-16 00:00CVE-2024-6792
6.4
Medium
stealthcopterYes
2024-07-03 00:00CVE-2024-6094
4.4
Medium
Dmitrii IgnatyevYes
Showing 1–10 of 17 reports
WP ULike – Like Buttons, Voting & Engagement Analytics banner
Latestv5.2.3

WP ULike – Like Buttons, Voting & Engagement Analytics

Alimir

Author

Alimir

4.8(281)
96/100
Last Updated
2026-08-29 (15d ago)
Active Installs
60,000+
Downloads
2,601,645
Requires WP
6.0+
Requires PHP
7.3.0+
Tested up to
WP 7.0.4
Created
2014-08-28 (12y ago)

Like buttons and post reactions for WordPress Most visitors read and leave without commenting, so you never learn what they liked. WP ULike adds one-click voting that takes no effort to use, giving you a clear signal on what resonates. No signup walls, no vote limits, no heavy setup. Install, activate, and voting goes live on posts. Open WP ULike → Statistics inside WordPress to see totals, top content, growth tips, and when your audience is most active. Optional IP anonymization, WordPress personal data export/erase, and flexible logging options help you align the plugin with your privacy policy. WP ULike supports posts out of the box and integrates with WooCommerce, BuddyPress, and bbPress. The frontend uses vanilla JavaScript (no jQuery) and works with major caching plugins. Engagement analytics, built in Pageviews tell you who showed up. Reactions tell you who cared. WP ULike ships a real dashboard inside WordPress, so you don’t need a separate analytics tool to read it. Free includes Overview, growth tips, engagement reports, when-to-publish insights, and vote logs. Dark mode and focus mode are built in. Pro (optional) adds who liked each post, deeper audience and content reports, and full WooCommerce store insights. Built for Bloggers & publishers: See which content earns appreciation, not just traffic. Online stores: Learn which products visitors value. Communities: Add voting to forums and activity feeds. Agencies & developers: Reliable on client sites, quick to deploy, straightforward to maintain. Free version: complete, no limits The free plugin is a full voting solution, not a trial. No caps on votes, posts, or usage. Included with free: Like buttons on posts via auto-display, [wp_ulike] shortcodes, or the ULike Button block Top List block and [wp_ulike_top] shortcode to showcase your most popular posts, comments, users, BuddyPress activities, and bbPress topics Statistics dashboard with Overview, growth tips, engagement reports, publish-timing insights, vote logs, dark mode, and focus mode Button customizer with real-time preview, four button styles, colors, icons, and RTL support Auto-display settings for posts, comments, BuddyPress, bbPress, and WooCommerce Settings backup (JSON export/import) and Site Health table check Privacy tools for user-linked vote data and optional IP anonymization Regular updates, WordPress coding standards, and security best practices (nonces, hardened AJAX, and more). WP ULike Pro Pro is optional. It extends the free plugin when you need more depth or design. Both plugins stay installed and active. Swap likes for emoji reactions or 5-star ratings and pick the reaction style that fits each page See who liked each post and how engaged readers really are (top fans, engagement vs page views) Know what to publish next with content intelligence, heatmaps, and top-country reports Compare likes to sales with full WooCommerce store reports 20 more button styles and Display Automation to match your brand and place buttons without code Rating and FAQ schema published as schema.org markup so search engines can read your ratings Need profiles, share buttons, bulk vote tools, Elementor widgets, or REST API? Pro includes those too. Compare Free vs Pro for the full list. Browse templates | Documentation

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C