CVE-2015-10116

low-risk
Published 2023-06-06

A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Favicon By Realfavicongenerator

Affected Vendors

Realfavicongenerator

References (6)

Patch https://github.com/wp-plugins/favicon-by-realfavicongenerator/commit/949a1ae7216...
Permissions Required https://vuldb.com/?ctiid.230661
Permissions Required https://vuldb.com/?id.230661
Patch https://github.com/wp-plugins/favicon-by-realfavicongenerator/commit/949a1ae7216...
Permissions Required https://vuldb.com/?ctiid.230661
Permissions Required https://vuldb.com/?id.230661
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal