CVE-2021-24437

6.1 mediumEPSS 0.8%

Medium (6.1) in realfavicongenerator favicon by realfavicongenerator. EPSS 0.8% chance of exploitation in the next 30 days.

The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-08-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

realfavicongenerator:favicon_by_realfavicongenerator

References

https://wpscan.com/vulnerability/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9
https://wpscan.com/vulnerability/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9

Check your stack JSON