Favicon Rotator CVE-2026-5725

Exploitation requires an attacker to deliver a crafted URL containing a malicious payload in any 'fvrt_'-prefixed request parameter of a site running Favicon Rotator ≤1.2.11, and to trick a user into clicking that link (UI:R) - the script only executes in the clicking victim's browser. No authentication is required of the attacker (PR:N) and no special plugin configuration is needed beyond having the vulnerable plugin installed and active, but the dependence on social-engineering a victim click and the reflected (non-persistent) nature are the key factors limiting real-world impact. Impact scales with the victim's privileges: an administrator victim yields the most damage.

This is a textbook moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that should be treated as a routine, lower-priority patch rather than an emergency. The network vector and lack of required privileges (PR:N) make it reachable by unauthenticated attackers, but the mandatory user interaction (UI:R) - the victim must click a crafted link - substantially lowers real-world risk, which is why confidentiality and integrity impact are only Low and availability is None. No EPSS score, SSVC decision, or KEV listing was provided in the input, and no public exploit was supplied, so there is no public exploit identified at time of analysis; the absence of exploitation telemetry is consistent with a non-targeted, low-urgency flaw. The signals are internally consistent (no CVSS-versus-description conflict), so the main caveat is simply that exploitation probability data (EPSS) is missing and cannot be used to further refine prioritization.

An attacker crafts a URL to a vulnerable site that embeds a malicious script in an 'fvrt_'-prefixed request parameter and distributes it via phishing, social media, or a malicious page. When a logged-in administrator or other user clicks the link, the unsanitized parameter is reflected into the page and the script executes in their browser session, potentially stealing cookies or performing actions on their behalf. No public exploit code was provided, and exploitation depends on successfully luring a victim to click (UI:R).