All In One Favicon

All In One Favicon has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2023; all 2 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 6.5 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Path Traversal.

Every one of the 2 issues recorded for All In One Favicon has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. All In One Favicon is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all All In One Favicon vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2023-24416

All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal

Read the full analysis

Vulnerability Records

2 records


2023-02-23 00:00	All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal All In One Favicon <= 4.7	`CVE-2023-24416`	6.5 Medium	Kévin Mosbahi (Mika)	Yes
2018-07-10 00:00	All In One Favicon <= 4.6 - Authenticated (Admin+) Stored Cross-Site Scripting All In One Favicon <= 4.6	`CVE-2018-13832`	5.5 Medium	Javier Olmedo	Yes

Showing 1–2 of 2 reports

Latestv4.8

All In One Favicon

Author

Garrett Grimm

4.5(82)

90/100

Last Updated

2023-08-08 (3y ago)

Active Installs

60,000+

Downloads

1,502,339

Requires WP

2.8+

Requires PHP

Tested up to

WP 6.2.11

Created

2010-05-06 (17y ago)

Check out the latest WordPress deals for your site. All In One Favicon adds favicons to your site and your admin pages. You can either use favicons you already uploaded or use the builtin upload mechanism to upload a favicon to your WordPress installation. All three favicon types are supported – .ico, .png and .gif (may be animated) Also, Apple Touch Icons are supported. Localization Bahasa Indonesia (id_ID) by EKO Czech (cs_CZ) by Neteyes Danish (da_DK) by GeorgWP Dutch (nl_NL) by Pieter Carette English (en_EN) by Arne Franken French (fr_FR) by Christophe Guilloux German (de_DE) by Arne Franken Hebrew (he_IL) by Ahrale Italian (it_IT) by Valerio Vendrame Polish (pl_PL) by Piotr Czarnecki Portuguese (pt_PT) by Miguel Ângelo Patricio Serbian (sr_RS) by Balkanboy Media team Simplified Chinese (zh_CN) by Tunghsiao Liu Spanish (es_ES) by Eddy Ernesto Ríos Slovak (sk_SK) by Viliam Brozman Swedish (sv_SE) by Christian Nilsson Turkish (tr_TR) by Ömer Faruk Karabulut Is your native language missing? Translating the plugin is easy if you understand english and are fluent in another language. I described in the FAQ how the translation works.

View on WordPress.org