CVE-2025-23927: Incredible Font Awesome Stored XSS Flaw

CVE-2025-23927 Overview

CVE-2025-23927 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Incredible Font Awesome WordPress plugin developed by massimo.serpilli. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability affects all plugin versions up to and including 1.0. Successful exploitation compromises the confidentiality, integrity, and availability of user sessions and site content. The scope change indicates that impact extends beyond the vulnerable component to other browser contexts.

Critical Impact
Authenticated users can inject stored JavaScript that executes when administrators or visitors load affected WordPress pages, enabling session theft, content tampering, and administrative account compromise.

Affected Products

Incredible Font Awesome WordPress plugin by massimo.serpilli
All versions from n/a through 1.0
WordPress sites with the incredible-font-awesome plugin installed and activated

Discovery Timeline

2025-01-16 - CVE-2025-23927 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23927

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Incredible Font Awesome plugin for WordPress. The plugin fails to properly sanitize or encode user-supplied input before storing it and rendering it back within generated web pages. Attackers with contributor or higher privileges can persist malicious JavaScript in plugin-controlled fields. When another user, including an administrator, loads a page containing the injected content, the payload executes in their browser session.

The attack requires network access, low privileges, and user interaction. The scope change confirms that injected scripts can influence resources outside the vulnerable plugin, including WordPress administrative interfaces. The Exploit Prediction Scoring System (EPSS) currently rates exploitation likelihood at 0.301%.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders stored input into HTML contexts. Input passed through plugin configuration or shortcode parameters is written to the DOM without HTML entity encoding or context-aware escaping. WordPress functions such as esc_html(), esc_attr(), and wp_kses() are either not applied or applied incorrectly.

Attack Vector

An authenticated attacker submits crafted input containing HTML or JavaScript to a plugin-controlled field. The malicious payload is persisted in the WordPress database. When a victim, typically an administrator viewing plugin output or a post containing the shortcode, loads the affected page, the browser executes the stored script. This can lead to cookie theft, forced administrative actions via CSRF, or delivery of secondary malware.

No verified public exploit code is available. Technical details are described in prose only; refer to the Patchstack XSS Vulnerability Alert for advisory information.

Detection Methods for CVE-2025-23927

Indicators of Compromise

Presence of <script> tags, onerror, onload, or javascript: handlers in stored plugin settings or WordPress wp_options and wp_postmeta entries related to incredible-font-awesome.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains after loading pages containing the plugin shortcode.
New or modified administrator accounts created shortly after an authenticated low-privilege user session accessed plugin functionality.

Detection Strategies

Audit WordPress database tables for HTML or JavaScript syntax within fields written by the incredible-font-awesome plugin.
Deploy a Web Application Firewall (WAF) rule set that flags XSS payload patterns submitted to WordPress admin endpoints.
Review web server access logs for POST requests to plugin-managed endpoints from non-administrative user accounts.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script execution violations in browsers accessing WordPress admin pages.
Monitor WordPress audit logs for changes to plugin settings and shortcode content by low-privilege roles.
Alert on creation of new administrator accounts or modifications to user capabilities immediately following plugin interaction.

How to Mitigate CVE-2025-23927

Immediate Actions Required

Deactivate and remove the Incredible Font Awesome plugin from all WordPress installations until a patched version is confirmed.
Audit user roles and revoke contributor or higher access from accounts that do not require it.
Rotate administrator credentials and invalidate active sessions to mitigate potential session theft.

Patch Information

No patched version has been published at the time of NVD listing. The vulnerability affects Incredible Font Awesome through version 1.0, and no fixed release is documented in the Patchstack advisory. Administrators should uninstall the plugin and monitor the vendor page for a security update.

Workarounds

Replace the plugin with a maintained Font Awesome integration that receives regular security updates.
Deploy a WAF with rules that filter script tags and event handlers in POST parameters targeting WordPress admin URLs.
Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources across WordPress pages.

bash

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate incredible-font-awesome
wp plugin delete incredible-font-awesome