Better Font Awesome Vulnerabilities

[en] The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Feb 13, 2023

CVE-2022-4512 on NVD →

The Better Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes (such as 'title', 'size', and class strings) in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to in...

CVSS:

6.4

Affected:

up to 2.0.3

Fixed in:

2.0.4

Disclosed:

Jan 18, 2023

CVE-2022-4512 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.

Affected:

up to 2.0.2

Fixed in:

2.0.2

Disclosed:

Sep 9, 2022

CVE-2022-37405 on NVD →

The Better Font Awesome plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_options function in versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.

CVSS:

6.5

Affected:

2.0.1 – 2.0.1

Fixed in:

2.0.2

Disclosed:

Aug 26, 2022

The Better Font Awesome plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_options function in versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.

Affected:

up to 2.0.2

Fixed in:

2.0.2

Disclosed:

Aug 26, 2022

The Better Font Awesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the save_options function. This makes it possible for unauthenticated attackers to change the plugin's settings, via forged request gr...

CVSS:

8.8

Affected:

up to 2.0.1

Fixed in:

2.0.2

Disclosed:

Aug 25, 2022

CVE-2022-37405 on NVD →