plugin

Simple Facebook Plugin Vulnerabilities

6 known security issues reported for the Simple Facebook Plugin WordPress plugin. Most recent disclosed Dec 31, 2025.

3 medium

Running Simple Facebook Plugin on your site? Check whether your installed version is affected.

Scan your site free

Simple Like Page <= 1.5.3 - Missing Authorization

medium

The Simple Like Page plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:
5.3
Affected:
up to 1.5.3
Fixed in:
2.0.0
Disclosed:
Dec 31, 2025

CVE-2025-63022 on NVD →

Simple Like Page Plugin [simple-facebook-plugin] <= 1.5.3 (unfixed)

unknown

[en] Missing Authorization vulnerability in Illia Simple Like Page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Like Page: from n/a through 1.5.3.

Affected:
up to 1.5.3
Fix:
No patched version reported
Disclosed:
Dec 31, 2025

CVE-2025-63022 on NVD →

Simple Like Page Plugin [simple-facebook-plugin] < 1.5.3 (closed)

unknown

[en] The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co...

Affected:
up to 1.5.3
Fixed in:
1.5.3
Disclosed:
May 30, 2024

CVE-2024-3583 on NVD →

Simple Like Page Plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

medium

The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib...

CVSS:
6.4
Affected:
up to 1.5.2
Fixed in:
1.5.3
Disclosed:
May 29, 2024

CVE-2024-3583 on NVD →

Simple Like Page Plugin [simple-facebook-plugin] < 1.5.2 (closed)

unknown

[en] The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contr...

Affected:
up to 1.5.2
Fixed in:
1.5.2
Disclosed:
Nov 7, 2023

CVE-2023-4888 on NVD →

Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

medium

The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributo...

CVSS:
6.4
Affected:
up to 1.5.1
Fixed in:
1.5.2
Disclosed:
Nov 6, 2023

CVE-2023-4888 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database