medium6.1
CVE-2021-24437
The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response,…
Impact
The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Realfavicongenerator | Favicon By Realfavicongenerator | before 1.3.22 |