Findings
- Several ways to call _likebtn_save_vote() with user-supplied data, including one convoluted method which involves setting up a domain name that includes “likebtn.com”. But it looks like voter fraud is the worst thing this enables
- Doesn’t escape SQL
- Note that the plugin doesn’t allow you to deactivate it without sending feedback to the plugin authors. But the feedback form appears to introduce a bug which allows any authenticated user (or any unauthenticated user via CSRF) to deactivate the plugin
Reason for the 'Potentially unsafe' result
The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability: