Filtered by vendor Newnine Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-3829 1 Newnine 1 Font Awesome 4 Menus 2024-08-03 4.8 Medium
The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2023-4718 1 Newnine 1 Font Awesome 4 Menus 2024-08-02 6.4 Medium
The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.