Reflected Cross-Site Scripting in Favicon Rotator Plugin for WordPress
CVE-2026-5725

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Favicon Rotator
Vendor
CVE Published:
10 October 2026

What is CVE-2026-5725?

The Favicon Rotator plugin for WordPress is susceptible to reflected cross-site scripting attacks due to a lack of proper input sanitization and output escaping. This vulnerability involves the 'fvrt_' prefixed request parameters, which allows unauthenticated attackers to execute arbitrary web scripts on affected pages. Users can be compromised when they are tricked into clicking on malicious links, putting their information at risk and potentially leading to further exploitation.

Affected Version(s)

Favicon Rotator 0 <= 1.2.11

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?reponame=&ne...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kitch
.