Simple Like Page <= 1.5.3 - Missing Authorization
medium
The Simple Like Page plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
- Affected:
- up to 1.5.3
- Fixed in:
- 2.0.0
- Disclosed:
- Dec 31, 2025
CVE-2025-63022 on NVD →
Simple Like Page Plugin [simple-facebook-plugin] <= 1.5.3 (unfixed)
unknown
[en] Missing Authorization vulnerability in Illia Simple Like Page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Like Page: from n/a through 1.5.3.
- Affected:
- up to 1.5.3
- Fix:
- No patched version reported
- Disclosed:
- Dec 31, 2025
CVE-2025-63022 on NVD →
Simple Like Page Plugin [simple-facebook-plugin] < 1.5.3 (closed)
unknown
[en] The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co...
- Affected:
- up to 1.5.3
- Fixed in:
- 1.5.3
- Disclosed:
- May 30, 2024
CVE-2024-3583 on NVD →
Simple Like Page Plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib...
- CVSS:
- 6.4
- Affected:
- up to 1.5.2
- Fixed in:
- 1.5.3
- Disclosed:
- May 29, 2024
CVE-2024-3583 on NVD →
Simple Like Page Plugin [simple-facebook-plugin] < 1.5.2 (closed)
unknown
[en] The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contr...
- Affected:
- up to 1.5.2
- Fixed in:
- 1.5.2
- Disclosed:
- Nov 7, 2023
CVE-2023-4888 on NVD →
Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributo...
- CVSS:
- 6.4
- Affected:
- up to 1.5.1
- Fixed in:
- 1.5.2
- Disclosed:
- Nov 6, 2023
CVE-2023-4888 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database