Lucene search
Lana CodesWPEX-ID:4DE75DE5-E557-46DF-9675-E3F0220F4003HistoryDec 22, 2022 - 12:00 a.m.
Font Awesome < 4.3.2 - Contributor+ Stored XSS
2022-12-2200:00:00
Lana Codes
80
font awesome
stored xss
shortcode exploit
EPSS
0.001
Percentile
25.4%
The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
Exploit shortcode:
[icon name='circle-exclamation' title='" onmouseover="alert(1)']Related
wpvulndb
wpvulndb
Font Awesome < 4.3.2 - Contributor+ Stored XSS
2022-12-22 00:00:00
cve
cve
CVE-2022-4478
2023-01-16 16:15:12
openvas
openvas
WordPress Font Awesome Plugin < 4.3.2 XSS Vulnerability
2023-03-14 00:00:00
cvelist
cvelist
CVE-2022-4478 Font Awesome < 4.3.2 - Contributor+ Stored XSS
2023-01-16 15:37:57
nvd
nvd
CVE-2022-4478
2023-01-16 16:15:12
prion
prion
Cross site scripting
2023-01-16 16:15:00