EUVD-2026-13992
GHSA-27xg-j8cm-6xf2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Ed's Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eds_font_awesome shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Ed's Font Awesome plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the eds_font_awesome shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 2.0 are affected, allowing authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript that persists in pages and executes for all users viewing those pages. No evidence of active exploitation in the wild (KEV status unknown), but the vulnerability is straightforward to exploit given contributor access and represents a persistent compromise vector.
Technical ContextAI
The vulnerability exists in the Ed's Font Awesome WordPress plugin (CPE: cpe:2.3:a:waianaeboy702:ed's_font_awesome:*:*:*:*:*:*:*:*), specifically in the eds_font_awesome shortcode handler as evidenced by references to line 103 of eds_font_awesome.php in both the trunk and version 2.0 tag. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw. WordPress shortcodes process user-supplied attributes from page/post content; when these attributes are not properly sanitized before database storage or escaped before output to HTML, attackers can embed malicious scripts. The plugin fails to apply WordPress's sanitization functions (e.g., sanitize_text_field) on input or escaping functions (e.g., wp_kses_post, esc_attr) on output, allowing script injection through shortcode parameters.
RemediationAI
The primary remediation is to upgrade Ed's Font Awesome plugin to a version patched after 2.0 if available from the WordPress plugin repository (https://wordpress.org/plugins/eds-font-awesome/). If no patched version exists, disable or remove the plugin entirely. As an interim mitigation, restrict contributor-level access to only trusted users and review all existing pages/posts containing the eds_font_awesome shortcode for injected content. WordPress administrators should audit user roles, consider reducing contributor permissions to Editor or Author roles with further restrictions, and implement a Web Application Firewall (WAF) rule to detect script tags within shortcode attributes. For sites unable to patch immediately, monitor database queries for shortcode parameter injection patterns and implement Content Security Policy (CSP) headers to mitigate XSS payload execution impact.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today