Stored Cross-Site Scripting in Icon Widget Plugin for WordPress

CVE-2024-1993

Summary

The Icon Widget plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes within the plugin's shortcodes. Authenticated attackers, including users with contributor-level permissions and above, can exploit this flaw to inject malicious web scripts. The injected scripts execute when a user accesses the affected pages, posing a significant risk to site integrity and user security.

References