CVE-2024-6792 WP ULike < 4.7.2.1 - Subscriber+ Stored-XSS

2024-09-0606:00:02

WPScan

github.com

cve-2024-6792

wordpress

plugin

vulnerability

stored-xss

AI Score

Confidence

High

EPSS

Percentile

9.5%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:wpulike:wp_ulike:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "wpulike",
    "product": "wp_ulike",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.7.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]