CVE-2018-13832 All In One Favicon <= 4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
MediumCVSS 4.8
EPSS 2.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| techotronic all in one favicon | < 4.6 | 4.6 |
| wordpress all-in-one-favicon(WordPress) | < 4.7 | 4.7 |
References
- hackpuntes.com exploit third-party-advisory
- 45056 exploit third-party-advisory vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org