Font Awesome Vulnerabilities

The Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web s...

CVSS:

6.4

Affected:

up to 4.3.1

Fixed in:

4.3.2

Disclosed:

Dec 22, 2022

CVE-2022-4478 on NVD →

The Font Awesome plugin for WordPress versions 4.0.0-rc15 and 4.0.0-rc16 are vulnerable to API Token Exposure. The vulnerability exposes the Font Awesome API token and access token for users who have configured the plugin to use a kit. If compromised, these tokens could give an unauthorized person access to that user’s...

CVSS:

6.5

Affected:

4.0.0-rc15 – 4.0.0-rc15, 4.0.0-rc16 – 4.0.0-rc16

Fixed in:

4.0.0-rc17

Disclosed:

Mar 11, 2020