CVE-2026-5725

6th percentile - higher than 6% of all known CVEs

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions up to and including 1.2.11 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

An unauthenticated attacker can exploit this to inject malicious scripts that execute in the victim's browser, leading to data theft, session hijacking, or other attacks. The risk is especially high if users click on malicious links.

Update the Favicon Rotator plugin to the latest version with the fix. Also educate users to avoid clicking on suspicious links.