PLUGIN SECURITY
Is Menu Icons safe?
Add icons to WordPress navigation menus easily — pick from Font Awesome, Dashicons, image icons & more. Style menu items with custom colors & sizes.
What this plugin does
- Slug:
menu-icons - Author: Themeisle
- 100000+ active installs
- 98/100 rating (848 reviews on wordpress.org)
- 4552440 all-time downloads
- On WordPress.org since 2014-02-20
DashiconsFont Awesomeimage iconsmenu iconsNavigation Menu
Maintenance status
- Latest known version: 0.13.23
- Last updated: 2026-08-20 6:48pm GMT
- Tested up to WordPress: 7.1
Known vulnerabilities
2 known CVEs on file for Menu Icons.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-4635 | Menu Icons by Themeisle – Add Icons to Navigation Menus [menu-icons] < 0.13.14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 0.13.14 | 0.13.14 | 2024-05-15 | ✓ fixed in latest |
| — | Menu Icons by Themeisle – Add Icons to Navigation Menus [menu-icons] < 0.13.21 | — | Unknown | < 0.13.21 | 0.13.21 | 0000-00-00 | ✓ fixed in latest |
| CVE-2026-1755 | Menu Icons by ThemeIsle < 0.13.21 - Authenticated (Author+) Stored Cross-Site Scripting | — | Unknown | < 0.13.21 | 0.13.21 | — | ✓ fixed in latest |
How to fix it
Keep Menu Icons updated — 0.13.23 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Advanced Custom Fields: Font Awesome Field — 90000+ active installs — 98/100 (36) — max PHP 8.4
- Better Font Awesome — 60000+ active installs — 90/100 (86) — max PHP 8.4
- WP Font Awesome — 10000+ active installs — 98/100 (9) — max PHP 8.4
- JVM Rich Text Icons — 3000+ active installs — 100/100 (10) — max PHP 8.4
- Block for Font Awesome — 1000+ active installs — 84/100 (5)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.