CVE-2026-42649

7th percentile - higher than 7% of all known CVEs

Versions of Favicon Rotator up to 1.2.11 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

This vulnerability may lead to user data theft or session hijacking, posing a serious threat to the application's security and its users.

It is recommended to update Favicon Rotator to the latest version to mitigate this vulnerability and conduct a security audit of the application.