Comments Like Dislike Vulnerabilities

The Comments Like Dislike plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.2.2 due to use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for authenticated attackers with subscriber privileges and above to bypass IP restrictions...

CVSS:

4.3

Affected:

up to 1.2.2

Fixed in:

1.2.3

Disclosed:

Feb 12, 2024

CVE-2024-25906 on NVD →

The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers with minimal permissions, such as a s...

CVSS:

4.3

Affected:

up to 1.2.0

Fixed in:

1.2.1

Disclosed:

Aug 16, 2023

CVE-2023-3244 on NVD →

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes,...

CVSS:

5.3

Affected:

up to 1.1.4

Fixed in:

1.1.4

Disclosed:

Jun 7, 2021

CVE-2021-24379 on NVD →