CVE-2025-25115: Like Dislike Plus Counter XSS Vulnerability

CVE-2025-25115 Overview

CVE-2025-25115 is a stored Cross-Site Scripting (XSS) vulnerability in the Zeshan Abdullah Like dislike plus counter WordPress plugin (slug: like-dislike-plus-counter). The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. It affects all plugin versions up to and including 1.0.

An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browser context of any visitor who loads the affected page. Because the payload is stored server-side, exploitation is repeatable and can affect administrators.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary script in a victim's browser, hijack sessions, perform actions on behalf of administrators, and pivot to further compromise the WordPress site.

Affected Products

Zeshan Abdullah Like dislike plus counter plugin for WordPress
All versions from n/a through <= 1.0
WordPress sites with the like-dislike-plus-counter plugin activated

Discovery Timeline

2025-03-03 - CVE-2025-25115 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25115

Vulnerability Analysis

The Like dislike plus counter plugin fails to sanitize and encode user-controlled input before rendering it in web page output. This produces a stored XSS condition where malicious markup is persisted to the WordPress database and later served to visitors without escaping.

Stored XSS in WordPress plugins is particularly impactful because injected payloads execute in the context of the site origin. Attackers can steal authentication cookies, forge administrative requests, modify site content, or redirect users to malicious hosts. The scope-changed impact reflects that the injected script crosses the trust boundary between the low-privileged submitter and higher-privileged viewers.

Exploitation requires the attacker to be authenticated with low privileges and depends on user interaction, such as an administrator loading a page that renders the persisted payload. The Patchstack WordPress Vulnerability Report documents the affected plugin surface.

Root Cause

The root cause is missing output encoding and input sanitization in code paths that render user-provided data. WordPress provides helpers such as esc_html(), esc_attr(), wp_kses(), and sanitize_text_field() for this purpose. The plugin does not apply these functions consistently before echoing stored values into the page.

Attack Vector

The attack is network-based and requires low-privileged authenticated access to submit content processed by the plugin. Once stored, the payload triggers whenever a user renders the affected page, delivering XSS in the site's origin context. The vulnerability mechanism follows the standard stored XSS pattern: injection into a persistent store, followed by unencoded reflection on subsequent requests. Refer to the vendor advisory for specific injection sinks and payload requirements.

Detection Methods for CVE-2025-25115

Indicators of Compromise

Presence of <script> tags, javascript: URIs, or on* event handlers in plugin-managed database tables
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that use the plugin
New or modified WordPress administrator accounts following suspicious page views
Anomalous cookie theft telemetry or session reuse from geographically inconsistent IPs

Detection Strategies

Query the WordPress database (wp_options, wp_postmeta, and plugin-specific tables) for HTML or JavaScript markup in fields expected to contain plain text
Deploy a Web Application Firewall (WAF) rule set that flags XSS payload signatures targeting like-dislike-plus-counter endpoints
Enable a Content Security Policy (CSP) report-only header to surface unauthorized inline script execution

Monitoring Recommendations

Monitor WordPress audit logs for content edits by low-privileged accounts followed by administrator page views
Alert on browser errors or CSP violation reports originating from pages rendered by the plugin
Track plugin version inventory and flag any WordPress site still running like-dislike-plus-counter version 1.0 or earlier

How to Mitigate CVE-2025-25115

Immediate Actions Required

Deactivate and remove the Like dislike plus counter plugin until a patched release is confirmed by the vendor
Audit stored content within plugin-managed fields and remove any injected HTML or script markup
Rotate WordPress administrator passwords and invalidate active sessions if suspicious content is discovered
Restrict who can submit content processed by the plugin by tightening WordPress role assignments

Patch Information

No patched release is identified in the CVE record; the vulnerability affects versions through <= 1.0. Monitor the Patchstack advisory and the plugin's WordPress.org page for a fixed version. Until a fix ships, treat removal as the primary mitigation.

Workarounds

Place the affected WordPress site behind a WAF configured with XSS signatures and virtual patching for the like-dislike-plus-counter plugin
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Limit registration and low-privileged account creation to reduce the pool of potential attackers

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate like-dislike-plus-counter
wp plugin delete like-dislike-plus-counter

# Example: strict CSP header in an Apache .htaccess file
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"