CVE-2026-2358: WP ULike Plugin Stored XSS Vulnerability

CVE-2026-2358 Overview

CVE-2026-2358 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WP ULike plugin for WordPress in all versions up to and including 5.0.1. The flaw resides in the [wp_ulike_likers_box] shortcode template attribute, where the plugin calls html_entity_decode() on attribute values without performing subsequent output sanitization. This decoding step effectively bypasses WordPress's wp_kses_post() content filtering, allowing authenticated users with Contributor-level access or above to inject arbitrary scripts into posts. Injected scripts execute when a visitor accesses the affected page, provided the post has at least one like recorded.

Critical Impact

Authenticated contributors can store JavaScript that executes in any visitor's browser, enabling session theft, administrative action forgery, and content manipulation on affected WordPress sites.

Affected Products

• WP ULike WordPress plugin versions up to and including 5.0.1
• WordPress sites permitting Contributor-level or higher user registrations
• Sites using the [wp_ulike_likers_box] shortcode on published content

Discovery Timeline

• 2026-03-11 - CVE-2026-2358 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-2358

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting issue classified under [CWE-79]. WP ULike processes the template attribute of the [wp_ulike_likers_box] shortcode by passing the value through html_entity_decode(). WordPress applies wp_kses_post() filtering to post content before storage, which strips dangerous HTML and script constructs. However, attackers can submit HTML entity-encoded payloads (for example, <script>) that pass through wp_kses_post() unchanged because they are inert text. When the shortcode renders, html_entity_decode() converts those entities back into executable HTML, and the output is emitted without further sanitization.

This pattern defeats the WordPress content filtering model. The injected markup persists in the database and triggers in every visitor's browser session whenever the rendered page is loaded.

Root Cause

The root cause is missing output sanitization after entity decoding within the shortcode handler. The plugin relies on input-time filtering provided by WordPress core, but then reverses that filtering at render time by decoding HTML entities. The shortcode hook in includes/hooks/shortcodes.php and the utility functions in includes/functions/utilities.php process the template attribute without applying esc_html(), esc_attr(), or an allowlist filter before output.

Attack Vector

An authenticated attacker with Contributor-level privileges or higher creates or edits a post containing the [wp_ulike_likers_box] shortcode with a template attribute that includes HTML entity-encoded JavaScript. The encoded payload survives wp_kses_post() filtering during save. The post must receive at least one like to trigger rendering of the likers box. When any visitor loads the page, the decoded script executes in the visitor's browser context, potentially including administrators who review pending content.

No verified public exploit code is available. Technical details and the fix are documented in the GitHub Commit Details and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-2358

Indicators of Compromise

• Posts or pages containing the [wp_ulike_likers_box] shortcode with unusual template attribute values containing HTML entities such as <, >, <, or <.
• Database post_content entries with encoded <script>, <img onerror=, or <svg onload= patterns adjacent to WP ULike shortcodes.
• Unexpected outbound requests from visitor browsers to attacker-controlled domains originating on pages that render likers boxes.

Detection Strategies

• Query the WordPress wp_posts table for the shortcode pattern wp_ulike_likers_box combined with HTML entity sequences in the template parameter.
• Review audit logs for Contributor and Author account activity that creates or edits posts containing WP ULike shortcodes.
• Inspect rendered HTML output of pages using WP ULike for unexpected inline JavaScript or event handler attributes.

Monitoring Recommendations

• Enable WordPress activity logging to capture post revisions by lower-privileged users for editorial review.
• Monitor web server access logs for anomalous referer chains and JavaScript fetches originating from pages rendering the likers box.
• Apply a Content Security Policy that restricts inline script execution to flag and block injected payloads.

How to Mitigate CVE-2026-2358

Immediate Actions Required

• Update the WP ULike plugin to a version newer than 5.0.1 that includes the fix referenced in the upstream changeset.
• Audit existing posts and pages for the [wp_ulike_likers_box] shortcode and remove or sanitize any template attribute containing HTML entities.
• Review Contributor, Author, and Editor accounts and revoke access for any users who do not require posting privileges.

Patch Information

The vendor addressed the vulnerability in the WordPress.org repository. Review the upstream fix in the WordPress Trac Changeset History and the corresponding GitHub Commit Details. The fix applies proper output sanitization to shortcode attribute values after entity decoding.

Workarounds

• Deactivate the WP ULike plugin until the patched version is deployed if the like functionality is non-essential.
• Restrict the unfiltered_html capability and review which roles can publish posts containing shortcodes.
• Deploy a web application firewall rule that blocks HTTP requests containing HTML entity-encoded <script> patterns within WP ULike shortcode attributes.

# Configuration example: identify vulnerable shortcode usage in the WordPress database
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wp_ulike_likers_box%' AND (post_content LIKE '%<%' OR post_content LIKE '%&#x%' OR post_content LIKE '%<%');"