blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24379

MEDIUM 5.3 CVSS 3.1
Published
June 21, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-863
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side

Affected WordPress components

  • Comments Like Dislike Plugin · comments-like-dislike
    Confirmed match Active
    From 1.1.4 (including) to 1.1.4 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Comments Like Dislike — From 1.1.4 (including) to 1.1.4 (excluding)
  • wphappycoders comments_like_dislike — Before 1.1.4

References

  • wpscan.com https://wpscan.com/vulnerability/aae7a889-195c-45a3-bbe4-e6d4cd2d7fd9 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record