CVE-2021-24437

CVE-2021-24437: Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)

Vendor Unknown

Product Favicon by RealFaviconGenerator

Weakness CWE-79 · XSS

Published August 30, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.

Key dates

02Disclosure timeline

August 30, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24437

Related vulnerabilities

04Related CVE

CVE-2025-30977 WordPress Chaport <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability CVE-2022-2924 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm CVE-2026-27740 Discourse has Stored XSS in AI Triage Automation CVE-2021-24850 Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting CVE-2025-58031 WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability