CVE-2021-24437: Realfavicongenerator Favicon By Realfavicongenerator

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.

Affected products

• Realfavicongenerator Favicon By Realfavicongenerator: before 1.3.22 (fixed in 1.3.22)

Published 2021-08-30. Last modified 2026-06-17.