CVE-2022-0471

MEDIUM 6.1CVE-2022-0471 · Published 11/04/2022 · updated 17/06/2026

In short

CVE-2022-0471 is a MEDIUM (CVSS 6.1) vulnerability affecting favicon by realfavicongenerator (realfavicongenerator).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.2% of all vulnerabilities.
Fix: update to 1.3.23 or later.

Package	Affected versions	Patched versions
favicon by realfavicongenerator realfavicongenerator	`< 1.3.23`	`1.3.23`

Description

The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue

References

plugins.trac.wordpress.org/changeset/2695862 · Patch
wpscan.com/vulnerability/499bfee4-b481-4276-b6ad-0eead6680f66 · Exploit

More vulnerabilities in favicon by realfavicongenerator

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free