CVE-2018-13832

MEDIUM 4.8CVE-2018-13832 · Published 16/07/2018 · updated 17/06/2026

In short

CVE-2018-13832 is a MEDIUM (CVSS 4.8) vulnerability affecting all in one favicon (techotronic).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.9% of all vulnerabilities.
Fix: update to 4.6 or later.

Package	Affected versions	Patched versions
all in one favicon techotronic	`< 4.6`	`4.6`

Description

Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.

References

hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes · Exploit
exploit-db.com/exploits/45056 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free