Lucene search
Lana CodesWPVDB-ID:4DE75DE5-E557-46DF-9675-E3F0220F4003HistoryDec 22, 2022 - 12:00 a.m.
Font Awesome < 4.3.2 - Contributor+ Stored XSS
2022-12-2200:00:00
Lana Codes
wpscan.com
11
font awesome
stored xss
shortcode validation
low-level users
admins
EPSS
0.001
Percentile
25.4%
The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
PoC
Exploit shortcode: [icon name=‘circle-exclamation’ title=‘" onmouseover="alert(1)’]
Related
openvas
openvas
WordPress Font Awesome Plugin < 4.3.2 XSS Vulnerability
2023-03-14 00:00:00
cvelist
cvelist
CVE-2022-4478 Font Awesome < 4.3.2 - Contributor+ Stored XSS
2023-01-16 15:37:57
nvd
nvd
CVE-2022-4478
2023-01-16 16:15:12
wpexploit
wpexploit
Font Awesome < 4.3.2 - Contributor+ Stored XSS
2022-12-22 00:00:00
prion
prion
Cross site scripting
2023-01-16 16:15:00
cve
cve
CVE-2022-4478
2023-01-16 16:15:12