Stored Cross-Site Scripting Vulnerability in Font Awesome 4 Menus Plugin for WordPress

CVE-2023-4718

Summary

The Font Awesome 4 Menus plugin for WordPress has a vulnerability that allows authenticated attackers with contributor-level and higher permissions to exploit stored cross-site scripting via the 'fa' and 'fa-stack' shortcodes. This weakness is due to inadequate input sanitization and output escaping on user-supplied attributes, enabling attackers to inject arbitrary web scripts. These scripts are executed whenever a user visits the affected page, compromising user security and potentially leading to further attacks.

References