CVE-2026-116552 in Like Button Rating LikeBtn Plugin
Summary
by MITRE • 10/30/2026
The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which would otherwise hash stored IP values and neutralize the payload. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The LikeBtn plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within versions up to 2.6.64. This vulnerability stems from insufficient input sanitization and output escaping mechanisms when processing data associated with the HTTP_CLIENT_IP header, commonly referred to as the Client-IP parameter. The core technical failure lies in the application's handling of client identity information during request processing. Instead of validating or encoding this incoming data before storage, the plugin directly incorporates it into its database records without adequate protection against malicious script injection. This architectural oversight allows an attacker to embed executable JavaScript code within what appears to be standard IP address fields, effectively turning a routine logging mechanism into a vector for persistent attacks.
The operational impact of this vulnerability is significant due to its stored nature and the specific conditions required for exploitation. Unlike reflected XSS where the payload executes immediately in the context of the victim's browser during a single request, Stored XSS persists on the server side. When an administrator or any user with sufficient privileges views pages that display this data, the malicious script executes within their session context. This can lead to severe consequences such as session hijacking, administrative account takeover, defacement of the website, or redirection to phishing sites. The attacker does not need authentication to inject the payload initially; however, successful exploitation is contingent upon two specific factors: first, the site administrator must have disabled the default GDPR compliance feature which hashes stored IP values and neutralizes such payloads; second, an action by a privileged user is required to trigger the execution of the injected script. This means that while any unauthenticated attacker can plant the code, they rely on legitimate users with higher privileges to activate it, creating a social engineering component to the attack chain.
From a classification perspective, this vulnerability aligns closely with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The specific variant is Stored XSS because the malicious script is saved on the target server and retrieved later when legitimate users access affected pages. In terms of adversary tactics, this behavior corresponds to techniques found in the MITRE ATT&CK framework under Initial Access via Valid Accounts or User Execution, depending on how the initial injection is achieved relative to privilege escalation requirements. The reliance on disabling security features like GDPR compliance highlights a common risk pattern where convenience overrides security controls, leaving systems exposed to known vulnerability classes.
Mitigation strategies must address both immediate remediation and long-term configuration hardening. The most effective solution is to upgrade the LikeBtn plugin to version 2.6.65 or later, where developers have implemented proper input validation and output encoding for all user-supplied data including HTTP headers. For organizations unable to update immediately due to compatibility constraints, disabling access to affected endpoints if possible can reduce exposure. Furthermore, administrators should ensure that security features such as GDPR compliance remain enabled even in non-EU jurisdictions, as these often provide essential sanitization layers against common web attacks. Regular auditing of plugin configurations and keeping all WordPress components updated are critical practices to prevent similar vulnerabilities from being exploited in the future.