PLUGIN SECURITY
The official way to use Font Awesome Free or Pro icons on your WordPress site, brought to you by the Font Awesome team.
font-awesomeFontAwesomeiconiconfontSVG iconwebfont
1 known CVE on file for Font Awesome. Reported between 2020 and 2022.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-4478 | Font Awesome [font-awesome] < 4.3.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.3.2 | 4.3.2 | 2022-12-22 | — |
| — | Font Awesome [font-awesome] >= 4.0.0-RC15 - <= 4.0.0-RC16 | — | Unknown | 4.0.0-RC15–4.0.0-RC16 | 4.0.0-RC16 | 2020-03-11 | — |
| — | Font Awesome [font-awesome] >= 4.0.0-rc15 - <= 4.0.0-rc16 | — | Unknown | 4.0.0-rc15–4.0.0-rc16 | 4.0.0-rc16 | 2020-03-11 | — |
| — | Font Awesome [font-awesome] >= 4.0.0-rc15 - <= 4.0.0-rc16 | — | Unknown | 4.0.0-rc15–4.0.0-rc16 | 4.0.0-rc16 | — | — |
Update the WordPress Font Awesome plugin to the latest available version (at least 4.3.2). Lana Codes discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Font Awesome Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.3.2.
Source: Patchstack
Sensitive Information Disclosure vulnerability discovered in WordPress Font Awesome plugin (versions 4.0.0-RC15 - 4.0.0-RC16).
Source: Patchstack
The Font Awesome plugin for WordPress versions 4.0.0-rc15 and 4.0.0-rc16 are vulnerable to API Token Exposure. The vulnerability exposes the Font Awesome API token and access token for users who have configured the plugin to use a kit. If compromised, these tokens could give an unauthorized person access to that user’s list of kits and kit settings.
Source: Wordfence
The vulnerability exposes the Font Awesome API token and access token for users who have configured the plugin to use a kit. If compromised, these tokens could give an unauthorized person access to that user’s list of kits and kit settings.
Source: WPScan
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.