WordPress Favicon plugin <= 1.3.20 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability discovered by renniepak in WordPress Favicon plugin (versions <= 1.3.20).

Solution

           According to WPScanTeam, there were attempts to contact the vendor, but the vulnerability was disclosed due to the vendor's lack of response.

Timeline (WPScanTeam):
June 28th, 2021 - Details sent to vendor
July 9th, 2021 - Escalated to WP due to lack of response from vendor
July 27th, 2021 - No update, disclosing
August 9th, 2021 - v1.3.22 released, fixing the issue