Plateforme
wordpress
Composant
like-it
Corrigé dans
2.2.1
CVE-2025-12404 identifies a Cross-Site Scripting (XSS) vulnerability affecting the Like-it plugin for WordPress. This flaw allows unauthenticated attackers to inject malicious web scripts by exploiting insufficient nonce validation within the likeit_conf() function. The vulnerability impacts versions 0.0.0 through 2.2 of the plugin and requires an attacker to trick a site administrator into performing an action. A fix is expected to be released by the vendor.
Successful exploitation of CVE-2025-12404 allows an attacker to inject arbitrary JavaScript code into a WordPress site. This can lead to various malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data. The attacker needs to craft a Cross-Site Request Forgery (CSRF) attack, tricking a site administrator into clicking a malicious link or visiting a compromised page. The blast radius is limited to users who interact with the affected WordPress site and are susceptible to CSRF attacks.
CVE-2025-12404 was publicly disclosed on 2025-11-18. No public proof-of-concept (PoC) code has been released at the time of writing. It is not currently listed on the CISA KEV catalog. The EPSS score is likely to be Low to Medium, given the requirement for administrator interaction and the absence of a public exploit.
WordPress websites utilizing the Like-it plugin, particularly those with site administrators who are susceptible to social engineering attacks or phishing attempts, are at risk. Shared hosting environments where multiple websites share the same server resources may also be affected if one site is compromised.
• wordpress / composer / npm:
grep -r 'likeit_conf(' /var/www/html/wp-content/plugins/like-it/• generic web:
curl -I https://example.com/wp-content/plugins/like-it/ | grep -i 'X-Frame-Options'• wordpress / composer / npm:
wp plugin list | grep like-itdisclosure
Statut de l'Exploit
EPSS
0.03% (percentile 7%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2025-12404 is to upgrade the Like-it plugin to a version containing the security fix. If upgrading is not immediately feasible, consider implementing stricter CSRF protection measures at the web server level, such as implementing double-submit cookies or utilizing a Web Application Firewall (WAF) with CSRF protection rules. Regularly review WordPress plugin configurations and ensure that only trusted plugins are installed and kept up-to-date. After upgrading, confirm the fix by attempting to trigger the vulnerable likeit_conf() function with a forged request and verifying that the action is blocked.
Aucun correctif connu n'est disponible. Veuillez examiner attentivement les détails de la vulnérabilité et mettre en œuvre des mesures d'atténuation en fonction de la tolérance au risque de votre organisation. Il peut être préférable de désinstaller le logiciel affecté et de trouver un remplacement.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2025-12404 is a Cross-Site Scripting vulnerability in the Like-it WordPress plugin, allowing attackers to inject malicious scripts via forged requests due to missing nonce validation.
You are affected if your WordPress site uses the Like-it plugin in versions 0.0.0 through 2.2. Upgrade to a patched version to resolve the vulnerability.
The recommended fix is to upgrade the Like-it plugin to a version containing the security patch. If upgrading is not possible, implement stricter CSRF protection measures.
There is no confirmed active exploitation of CVE-2025-12404 at this time, but it is crucial to apply the patch to prevent potential future attacks.
Please refer to the WordPress plugin repository or the Like-it plugin developer's website for the official advisory and update information.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.