The SS Font Awesome Icon plugin contains a stored Cross‑Site Scripting flaw that allows an attacker to insert malicious JavaScript into the site’s output. The weakness is a classic input‑neutralization issue (CWE‑79), enabling the attacker to execute arbitrary script in the browser context of any user who views the affected page. This could lead to session hijacking, defacement, or the delivery of more advanced malware.

Any WordPress site using the Shiful H SS Font Awesome Icon plugin up to and including version 4.1.3 is affected. No other product or version restrictions are documented.

The CVSS score of 6.5 categorises the vulnerability as moderate in severity. Its EPSS rating of less than 1 % indicates that real‑world exploitation is currently considered unlikely, and the issue is not listed in CISA’s KEV catalogue. Attackers would need to supply malicious input that is subsequently stored by the plugin – typically through an interface that accepts icon or shortcode data – and then lure a victim to view the resulting page. Infected content would run in the victim’s browser, providing the user with the attacker's payload. While the likelihood of exploitation is low, the impact of successful exploitation could be significant for sites that rely on this plugin.