（CVE-2025-5287）Likes and Dislikes Plugin插件SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-5287
• https://github.com/RandomRobbieBF/CVE-2025-5287
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/inprosysmedia-likes-dislikes-post/likes-and-dislikes-plugin-100-authenticated-subscriber-sql-injection
• https://www.cvedetails.com/cve/CVE-2025-5287/
• https://github.com/advisories/GHSA-2q5m-qpc5-76wp
• https://access.redhat.com/security/cve/cve-2025-5287
• https://s4e.io/tools/likes-and-dislikes-plugin-sql-injection-cve-2025-5287
• https://wpscan.com/vulnerability/85dc579d-edc4-421e-9bb1-09629dec527b/
• https://hackhalt.com/threat/cve-2025-5287/
• https://www.ameeba.com/blog/cve-2025-5287-sql-injection-vulnerability-detected-in-likes-and-dislikes-plugin-for-wordpress/

Related Vulnerabilities

• PoCCVE-2026-41948: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal
• JeecgBoot 积木报表 /jmreport/auto/export/python/plugin 代码执行漏洞
• PoCCVE-2025-14998: Branda WordPress plugin - Privilege Escalation
• PoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE
• PoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
• PoCCVE-2026-3001: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting
• PoCCVE-2025-6389: Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
• PoCCVE-2026-3296: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection
• Stripe Payment Plugin for WooCommerce /wc-api/WT_Stripe/ SQL 注入漏洞（CVE-2024-0705）
• 泛微 E-Cology /hrm/hrm_e9/orgChart/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp 目录遍历漏洞
• AVideo /plugin/API/get.json.php 文件包含漏洞（CVE-2026-33513）
• WWBN AVideo /objects/plugins.json.php 信息泄露漏洞 （CVE-2026-43885）
• PoCCVE-2025-48157: WordPress Formality Plugin <= 1.5.9 - Local File Inclusion