WordPress Plugin Vulnerabilities

Surbma | Font Awesome < 3.1 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
surbma-font-awesome
Fixed in 3.1

References

CVE
CVE-2024-51798
URL
https://patchstack.com/database/wordpress/plugin/surbma-font-awesome/vulnerability/wordpress-surbma-font-awesome-plugin-3-0-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
SOPROBRO
Verified
No
WPVDB ID
f22a32a8-1f47-450d-b358-1c877c11dffb

Timeline

Publicly Published
2024-11-08 (about 1 year ago)
Added
2024-11-14 (about 1 year ago)
Last Updated
2025-01-06 (about 1 year ago)

Other

Published
Title
Published
2024-02-12
Title
Livemesh Addons for Elementor < 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via animated_text_class
Published
2024-08-02
Title
Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS
Published
2025-01-16
Title
Winning Portfolio <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-12-27
Title
Easy Digital Downloads < 3.2.6 - Contributor+ Stored XSS
Published
2022-06-21
Title
Very Simple Breadcrumb <= 1.0 - Admin+ Stored Cross-Site Scripting