CVE-2021-24437CWE-79

Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)

published August 30, 2021

CVSS
—
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00827 · 57.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-30T14:11Z
EPSS history
Timeline
  • 30 AUG 14:11Z
    Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)
    cvelistv5