{"error":0,"message":null,"data":{"name":"Favicon by RealFaviconGenerator","plugin":"favicon-by-realfavicongenerator","link":"https:\/\/wordpress.org\/plugins\/favicon-by-realfavicongenerator\/","latest":"1789914120","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"63afef11f4571cf1aa60fad7abb329904701cee02dfaa2c7a22b491c52eecc45","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.3.22","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.3.22","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24437","name":"CVE-2021-24437","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24437","description":"[en] The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.","date":"2021-08-30"},{"id":"48b89ef88a48d8b2ea04e063dff0b3eb26149876","name":"WordPress Favicon plugin <= 1.3.20 - Reflected Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/favicon-by-realfavicongenerator\/vulnerability\/wordpress-favicon-plugin-1-3-20-reflected-cross-site-scripting-xss-vulnerability","description":"Reflected Cross-Site Scripting (XSS) vulnerability discovered by renniepak in WordPress Favicon plugin (versions <= 1.3.20).","date":"2021-07-27"},{"id":"2f54bc846e53f4d81ab99d118576f016226a4e77","name":"Favicon by RealFaviconGenerator <= 1.3.21 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/favicon-by-realfavicongenerator\/favicon-by-realfavicongenerator-1321-reflected-cross-site-scripting","description":"The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.","date":"2021-07-27"},{"id":"ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9","name":"Favicon by RealFaviconGenerator &lt; 1.3.22 - Reflected Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9","description":"The plugin does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.\r\n\r\n\r\nTimeline (WPScanTeam):\r\nJune 28th, 2021 - Details sent to vendor\r\nJuly 9th, 2021 - Escalated to WP due to lack of response from vendor\r\nJuly 27th, 2021 - No update, disclosing\r\nAugust 9th, 2021 - v1.3.22 released, fixing the issue","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"4965b05e4c29b9c36100f83b59c1c101592a102f76dbccfe5c9b67b123068723","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.3.23","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.3.23","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-0471","name":"CVE-2022-0471","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-0471","description":"[en] The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue","date":"2022-04-11"},{"id":"88167a5bada0af3e8112db07fbb69345bb7d48c0","name":"WordPress Favicon by RealFaviconGenerator plugin <= 1.3.22 - Reflected Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/favicon-by-realfavicongenerator\/vulnerability\/wordpress-favicon-by-realfavicongenerator-plugin-1-3-22-reflected-cross-site-scripting-xss-vulnerability","description":"Reflected Cross-Site Scripting (XSS) vulnerability discovered by Krzysztof Zaj\u0105c in WordPress Favicon by RealFaviconGenerator plugin (version <= 1.3.22).","date":"2022-03-21"},{"id":"cd4245be78ff2d0729c537af702b68fac3f49fcb","name":"Favicon by RealFaviconGenerator <= 1.3.22 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/favicon-by-realfavicongenerator\/favicon-by-realfavicongenerator-1322-reflected-cross-site-scripting","description":"The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue","date":"2022-03-21"},{"id":"499bfee4-b481-4276-b6ad-0eead6680f66","name":"Favicon by RealFaviconGenerator &lt; 1.3.23 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/499bfee4-b481-4276-b6ad-0eead6680f66","description":"The plugin does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"57b323dfb2416be2db6a4c552207c8ca4b96dc443c1e1c6ccb0359c3d5d2728b","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.2.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"79930e526299d79eadfb0077fdff197be8b08c88","name":"WordPress Favicon Plugin <= 1.2.12 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/favicon-by-realfavicongenerator\/vulnerability\/wordpress-favicon-plugin-1-2-12-cross-site-scripting","description":"Because of this vulnerability, attackers can trick the authenticated administrator of a WordPress site to download and install a faked favicon package.\nUpdate the plugin.","date":"2015-04-01"}],"impact":[]},{"uuid":"17366a92bbf65f07ad936c094f5b26cb82e52821a201ec0eacef1ad535d6212b","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.2.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"217acd0e-da43-49ca-b255-fa2bf8d11295","name":"Favicon by RealFaviconGenerator &lt;= 1.2.12 - Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/217acd0e-da43-49ca-b255-fa2bf8d11295","description":"The Favicon by RealFaviconGenerator WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.","date":null}],"impact":[]},{"uuid":"f92eba43f04fa713d09019c1ce3fac5532cd4d8d78ef50fbfae1c931850c0b52","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.2.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"5ee46584f7975ed4abf37b19455ae70c80d7f4b2","name":"Favicon by RealFaviconGenerator <= 1.2.12 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/favicon-by-realfavicongenerator\/favicon-by-realfavicongenerator-1212-reflected-cross-site-scripting","description":"The Favicon by RealFaviconGenerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018json_result_url\u2019 parameter in versions before 1.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2015-04-01"},{"id":"CVE-2015-10116","name":"CVE-2015-10116","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2015-10116","description":"[en] A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin\/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.\n\n[de] Es wurde eine Schwachstelle in RealFaviconGenerator Favicon Plugin bis 1.2.12 f\u00fcr WordPress entdeckt. Sie wurde als problematisch eingestuft. Hiervon betroffen ist die Funktion install_new_favicon der Datei admin\/class-favicon-by-realfavicongenerator-admin.php. Mit der Manipulation mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 1.2.13 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 949a1ae7216216350458844f50a72f100b56d4e7 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen.","date":"2023-06-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}]}},{"uuid":"b455c053f4325f9fd5a8bd3493ec95b459f5571a752e27c7b5f1057ef4e479f6","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.3.30","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.3.30","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-31422","name":"CVE-2024-31422","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-31422","description":"[en] Cross-Site Request Forgery (CSRF) vulnerability in Philippe Bernard Favicon.This issue affects Favicon: from n\/a through 1.3.29.","date":"2024-04-15"},{"id":"ec4a78a79a4f1828e838f60e3f261988f7fe58ba","name":"WordPress  Favicon Plugin    <= 1.3.29 is vulnerable to Cross Site Request Forgery (CSRF)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/favicon-by-realfavicongenerator\/vulnerability\/wordpress-favicon-by-realfavicongenerator-plugin-1-3-29-cross-site-request-forgery-csrf-vulnerability","description":"Update the WordPress Favicon plugin to the latest available version (at least 1.3.30).\nFearZzZz discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Favicon Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.3.30.\nThis vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"e6c5cebef779621e2c07620732c2385833e479ba","name":"Favicon <= 1.3.29 - Cross-Site Request Forgery to Notice Dismissal","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/favicon-by-realfavicongenerator\/favicon-1329-cross-site-request-forgery-to-notice-dismissal","description":"The Favicon plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.29. This is due to missing or incorrect nonce validation on the process_ignored_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2024-04-10"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"57b2fd1c617586e2869aef7c801a35a8eaf2aad380f28a29c60718e2a4b3c941","name":"Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator] < 1.3.47","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.3.47","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-42754","name":"CVE-2026-42754","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-42754","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phbernard Favicon favicon-by-realfavicongenerator allows Reflected XSS.This issue affects Favicon: from n\/a through <= 1.3.46.","date":"2026-05-27"},{"id":"085295418029dde1d5dcd5709489e6bb35516e58","name":"WordPress Favicon Plugin <= 1.3.46 is vulnerable to a medium priority Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/favicon-by-realfavicongenerator\/vulnerability\/wordpress-favicon-plugin-1-3-46-cross-site-scripting-xss-vulnerability","description":"<p>WordPress Favicon Plugin <= 1.3.46 is vulnerable to a medium priority Cross Site Scripting (XSS)<\/p><p>Software: Favicon<\/p><p>Fixed in version 1.3.47 <\/p><p>Affected Version <= 1.3.46<\/p><p>CVE: CVE-2026-42754<\/p>","date":"2026-05-30"},{"id":"a1bf79f5f22aa1018ca53d68ed27259359c1d699","name":"Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/favicon-by-realfavicongenerator\/favicon-by-realfavicongenerator-1346-unauthenticated-stored-cross-site-scripting","description":"The Favicon by RealFaviconGenerator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-05-30"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1780378760"}