CVE-2026-5725: Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix

Q: Which deployments are affected?

Favicon Rotator for WordPress is affected in all versions through 1.2.11. The available change reference indicates that version 1.2.12 is newer than the affected 1.2.11 release.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication and can supply malicious input through request parameters prefixed with "fvrt_". Exploitation requires persuading a user to perform an action such as clicking a crafted link, causing injected script to execute in the affected page.

Q: What impact can successful exploitation have?

The vulnerability can allow arbitrary web script injection through reflected cross-site scripting. The supplied severity vector indicates low confidentiality and integrity impact, no availability impact, and a changed scope.

Published Oct 10, 2026

Updated

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected Software

1 affected component

Favicon Rotator<=1.2.11

Event History

Oct 10, 2026

CVE Published

via MITRE·06:40 AM

Data Sourced

via MITRE·06:40 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Favicon Rotator for WordPress is affected in all versions through 1.2.11. The available change reference indicates that version 1.2.12 is newer than the affected 1.2.11 release.

What does an attacker need to exploit this issue?

An attacker does not need authentication and can supply malicious input through request parameters prefixed with "fvrt_". Exploitation requires persuading a user to perform an action such as clicking a crafted link, causing injected script to execute in the affected page.

What impact can successful exploitation have?

The vulnerability can allow arbitrary web script injection through reflected cross-site scripting. The supplied severity vector indicates low confidentiality and integrity impact, no availability impact, and a changed scope.

CVE-2026-5725: Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What impact can successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What impact can successful exploitation have?