Platform
wordpress
Component
like-it
Fixed in
2.2.1
CVE-2025-12404 identifies a Cross-Site Scripting (XSS) vulnerability affecting the Like-it plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious web scripts by exploiting insufficient nonce validation within the likeit_conf() function. The vulnerability impacts versions 0.0.0 through 2.2 of the plugin and requires an attacker to trick a site administrator into performing an action. A fix is expected to be released by the vendor.
Successful exploitation of CVE-2025-12404 allows an attacker to inject arbitrary JavaScript code into a WordPress site. This can lead to various malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data. The attacker needs to craft a Cross-Site Request Forgery (CSRF) attack, tricking a site administrator into clicking a malicious link or visiting a compromised page. The blast radius is limited to users who interact with the affected WordPress site and are susceptible to CSRF attacks.
CVE-2025-12404 was publicly disclosed on 2025-11-18. No public proof-of-concept (PoC) code has been released at the time of writing. It is not currently listed on the CISA KEV catalog. The EPSS score is likely to be Low to Medium, given the requirement for administrator interaction and the absence of a public exploit.
Exploit Status
EPSS
0.03% (7% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-12404 is to upgrade the Like-it plugin to a version containing the security fix. If upgrading is not immediately feasible, consider implementing stricter CSRF protection measures at the web server level, such as implementing double-submit cookies or utilizing a Web Application Firewall (WAF) with CSRF protection rules. Regularly review WordPress plugin configurations and ensure that only trusted plugins are installed and kept up-to-date. After upgrading, confirm the fix by attempting to trigger the vulnerable likeit_conf() function with a forged request and verifying that the action is blocked.
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-12404 is a Cross-Site Scripting vulnerability in the Like-it WordPress plugin, allowing attackers to inject malicious scripts via forged requests due to missing nonce validation.
You are affected if your WordPress site uses the Like-it plugin in versions 0.0.0 through 2.2. Upgrade to a patched version to resolve the vulnerability.
The recommended fix is to upgrade the Like-it plugin to a version containing the security patch. If upgrading is not possible, implement stricter CSRF protection measures.
There is no confirmed active exploitation of CVE-2025-12404 at this time, but it is crucial to apply the patch to prevent potential future attacks.
Please refer to the WordPress plugin repository or the Like-it plugin developer's website for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.