Perfect Font Awesome Integration Vulnerabilities

The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web sc...

CVSS:

6.4

Affected:

up to 2.3

Fixed in:

2.3.1

Disclosed:

Apr 1, 2025

CVE-2025-31861 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPOrbit Support Perfect Font Awesome Integration allows Stored XSS. This issue affects Perfect Font Awesome Integration: from n/a through 2.2.

Affected:

up to 2.3.1

Fixed in:

2.3.1

Disclosed:

Apr 1, 2025

CVE-2025-31861 on NVD →

[en] The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

Affected:

up to 2.3.1

Fixed in:

2.3.1

Disclosed:

Dec 12, 2024

CVE-2024-11891 on NVD →

The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w...

CVSS:

6.4

Affected:

up to 2.3

Fixed in:

2.3.1

Disclosed:

Dec 11, 2024

CVE-2024-11891 on NVD →