WordPress Icons Factory plugin <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function vulnerability

Missing Authorization to Unauthenticated Arbitrary File Deletion via deletefiles Function vulnerability discovered by johska in WordPress Plugin Icons Factory versions = 1.6.12...

CVE-2025-22573 WordPress Icons Enricher plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in copist Icons Enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through 1.0.8...

WordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

Software Icons Font Loader Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5860 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e7c1b6cac566 Credits Alex Thomas Required privilege...

WordPress Icons with Links Widget plugin <= 1.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Icons with Links Widget plugin versions = 1.2. Solution This plugin has been closed as of July 5, 2021 and is not available for download. This closure is temporary, pending a full review...