CVE-2022-0471

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Favicon by RealFaviconGenerator	>= 1.3.23, < 1.3.23

References

https://plugins.trac.wordpress.org/changeset/2695862Patch, Third Party Advisory
https://wpscan.com/vulnerability/499bfee4-b481-4276-b6ad-0eead6680f66Exploit, Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2695862Patch, Third Party Advisory
https://wpscan.com/vulnerability/499bfee4-b481-4276-b6ad-0eead6680f66Exploit, Patch, Third Party Advisory

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04725.4Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.CVE-2022-04734.8OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. W CVE-2022-04743.5Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set CVE-2022-04755.4Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in th CVE-2022-04765.5Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.CVE-2022-04774.9An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.CVE-2022-04788.8The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg p CVE-2022-04799.8The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a S CVE-2022-04805.5A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg CVE-2022-04817.5NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-04829.1Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.CVE-2022-04837.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before buil