Font Awesome 4 Menus Vulnerabilities

[en] The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 4.7.0

Fix:

No patched version reported

Disclosed:

Jan 16, 2024

CVE-2022-3829 on NVD →

[en] The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with c...

Affected:

up to 4.7.0

Fix:

No patched version reported

Disclosed:

Sep 2, 2023

CVE-2023-4718 on NVD →

The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contri...

CVSS:

6.4

Affected:

up to 4.7.0

Fix:

No patched version reported

Disclosed:

Sep 1, 2023

CVE-2023-4718 on NVD →

The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that...

CVSS:

5.5

Affected:

up to 4.7.0

Fix:

No patched version reported

Disclosed:

Nov 2, 2022

CVE-2022-3829 on NVD →