CVE-2021-24945: Likebtn Like Button Rating

High severity, CVSS 8.0. EPSS: 0.6% chance of exploitation in the next 30 days.

The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.

Affected products

• Likebtn Like Button Rating: before 2.6.38 (fixed in 2.6.38)

Published 2021-12-13. Last modified 2026-06-17.