https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12770.htmlhttps://patchthecve.com/cve/CVE-2024-12770.htmlWed, 17 Jun 2026 07:00:27 +0000MEDIUM 4.8: The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2025-22738.htmlhttps://patchthecve.com/cve/CVE-2025-22738.htmlWed, 17 Jun 2026 08:49:40 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alimir WP ULike wp-ulike allows Stored XSS.This issue affects WP ULike: from n/a through <= 4.7.6.https://patchthecve.com/cve/CVE-2024-7879.htmlhttps://patchthecve.com/cve/CVE-2024-7879.htmlWed, 17 Jun 2026 08:21:06 +0000MEDIUM 4.8: The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowedhttps://patchthecve.com/cve/CVE-2024-9649.htmlhttps://patchthecve.com/cve/CVE-2024-9649.htmlWed, 17 Jun 2026 08:24:58 +0000MEDIUM 4.3: The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7.4. This is due to missing or incorrect nonce validation on the wp_ulike_delete_history_api() function. This makes it possible for unahttps://patchthecve.com/cve/CVE-2024-7878.htmlhttps://patchthecve.com/cve/CVE-2024-7878.htmlWed, 17 Jun 2026 08:21:06 +0000MEDIUM 4.8: The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-6792.htmlhttps://patchthecve.com/cve/CVE-2024-6792.htmlWed, 17 Jun 2026 08:18:43 +0000LOW 3.5: The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.https://patchthecve.com/cve/CVE-2024-6094.htmlhttps://patchthecve.com/cve/CVE-2024-6094.htmlWed, 17 Jun 2026 08:17:16 +0000MEDIUM 4.8: The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-1797.htmlhttps://patchthecve.com/cve/CVE-2024-1797.htmlWed, 17 Jun 2026 07:05:01 +0000HIGH 8.8: The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to SQL Injection via the 'status' and 'id' attributes of the 'wp_ulike_counter' and 'wp_ulike' shortcodes in all versions up to, and including, 4.6.9 due to insufficient escaping on the user supplied parametehttps://patchthecve.com/cve/CVE-2024-1759.htmlhttps://patchthecve.com/cve/CVE-2024-1759.htmlWed, 17 Jun 2026 07:04:57 +0000MEDIUM 6.4: The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackhttps://patchthecve.com/cve/CVE-2024-1572.htmlhttps://patchthecve.com/cve/CVE-2024-1572.htmlWed, 17 Jun 2026 07:04:33 +0000MEDIUM 6.4: The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_ulike' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on the user supplied 'wrapper_class' attribute. This makes it possible for authe