Stored Cross-Site Scripting Vulnerability in WP Font Awesome Plugin

CVE-2023-5127

Summary

The WP Font Awesome plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping associated with the 'icon' attribute in user-supplied shortcodes. Authenticated users with contributor-level permissions or higher can exploit this vulnerability to inject arbitrary web scripts into web pages. These scripts will be executed whenever a user accesses the affected pages, potentially leading to unauthorized actions or data theft.

References