Better Font Awesome CVEs and Security Vulnerabilities

Vulnerabilities (Better Font Awesome)

CVE-2022-4512

Better Font Awesome < 2.0.4 - Contributor+ Stored XSS

The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Better Font Awesome Project

Products

Better Font Awesome

CVE-2022-37405

WordPress Better Font Awesome plugin <= 2.0.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed