CVE-2026-5725
Received Received - Intake

Reflected Cross-Site Scripting in Favicon Rotator WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-5725
EUVD
EUVD-2026-96214

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
archetyped Favicon Rotator 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Favicon Rotator WordPress plugin up to version 1.2.11 has a reflected cross-site scripting vulnerability. This occurs because user-supplied input in parameters starting with 'fvrt_' is not properly sanitized or escaped before being output in web pages. Attackers can exploit this by tricking users into clicking a malicious link, which executes arbitrary scripts in the user's browser.

Detection Guidance

Check WordPress installations for the Favicon Rotator plugin version 1.2.11 or lower. Inspect web server logs for suspicious URLs containing 'fvrt_' parameters with script-like input. Use tools like WP-CLI to list installed plugins and their versions.

Impact Analysis

An attacker could steal session cookies, redirect you to fake login pages, or perform actions on your behalf without consent. Since no authentication is required, anyone with a crafted link could exploit this. Users visiting infected sites may have their data compromised or accounts hijacked.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if exploited. Organizations using this plugin risk non-compliance penalties due to insufficient security controls.

Mitigation Strategies

Update the Favicon Rotator plugin to the latest version. If an update is unavailable, consider disabling or removing the plugin immediately. Implement web application firewalls to filter malicious requests targeting 'fvrt_' parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart