CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45842 – WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability
https://notcve.org/view.php?id=CVE-2022-45842
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores. Vulnerabilidad de Race Condition No Autorizada en WP ULike Plugin <= 4.6.4 en WordPress permite a los atacantes aumentar/disminuir puntuaciones de calificación. The WP ULike plugin for WordPress is vulnerable to Race Condition in versions up to, and including, 4.6.4. This can lead to unpredictable post rating changes when certain conditions are met. • https://patchstack.com/database/vulnerability/wp-ulike/wordpress-wp-ulike-plugin-4-6-3-race-condition-vulnerability?_s_id=cve • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2018-1000508 – WP ULike < 3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-1000508
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2. WP ULike en sus versiones 2.8.1 y 3.1 contiene una vulnerabilidad de Cross Site Scripting (XSS) en la pantalla Settings que puede resultar en que usuarios no autorizados hagan casi cualquier acción que pueda realizar un administrador. El ataque parece ser explotable mediante un administrador que visite una página de registros. • https://advisories.dxw.com/advisories/stored-xss-wp-ulike • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-1000511 – WP ULike < 3.2 - Missing Authorization
https://notcve.org/view.php?id=CVE-2018-1000511
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2. WP ULike 2.8.1 y 3.1 contiene una vulnerabilidad de control de acceso incorrecto en AJAX que puede resultar en que cualquiera pueda eliminar cualquier fila en determinadas tablas. El ataque parece ser explotable mediante un atacante que realice una petición AJAX. • https://advisories.dxw.com/advisories/wp-ulike-delete-rows • CWE-732: Incorrect Permission Assignment for Critical Resource CWE-862: Missing Authorization •