Font Awesome Integration Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-11891

Summary

The Perfect Font Awesome Integration plugin for WordPress exhibits a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes. This issue affects all versions up to and including 2.3 of the plugin. Authenticated attackers with contributor-level access or higher can exploit this vulnerability by injecting arbitrary web scripts through the plugin's 'pfai' shortcode. Consequently, these malicious scripts execute whenever users access the compromised pages, posing a significant risk to both site administrators and visitors.

References