Multicons

Multicons has one disclosed vulnerability in the WordSec catalog, all reported in 2015; it is fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Multicons has a vendor fix available, so running the current release closes it.

All of these findings were reported by Marcin Probola. Multicons is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Multicons vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.3CVE-2015-9424

Multicons [ Multiple Favicons ] <= 2.0 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Multicons banner
Latestv6.0

Multicons

doc4

Author

doc4

5.0(4)
100/100
Last Updated
2025-12-05 (9mo ago)
Active Installs
2,000+
Downloads
122,519
Requires WP
2.7+
Requires PHP
0+
Tested up to
WP 6.9.7
Created
2010-08-09 (16y ago)

Now includes favicons for Android devices. Completely re-written in version 4.2 Multicons is a multi-favicon code generator which automatically inserts the necessary meta tags for both favicons (site-wide and/or dashboard) and Apple Touch / iPhone icons. Please note that it will be necessary to update your icon link locations. Not sure what a favicon is? “A favicon (short for favorites icon), also known as a shortcut icon, website icon, URL icon, or bookmark icon is a 16×16 or 32×32 pixel square icon associated with a particular website or webpage. A web designer can create such an icon and install it into a website (or webpage) by several means, and most graphical web browsers will then make use of it. Browsers that provide favicon support typically display a page’s favicon in the browser’s address bar and next to the page’s name in a list of bookmarks. Browsers that support a tabbed document interface typically show a page’s favicon next to the page’s title on the tab. Some programs allow the user to select an icon of their own from the hard drive and associate it with a website.” – Wikipedia Favicons have a subtle, if small, role in building the branding of a website. When a user takes notice of a favicon it can often be a good indication they have come to the right place serving as visual representation of a website not only in the browser address bar but also when sifting through bookmarks. It is no secret that our eyes gravitate towards images before text and not just on the web but iPhones and iPads as well. The meta data output by Multicons: Website Favicon: Location: Website [and Dashboard if no Dashboard Favicon is specified] Meta tags generated: link rel=”shortcut icon” href=”http://www.yoursite.com/favicon.ico” link rel=”icon” type=”image/png” href=”http://www.yoursite.com/favicon.ico” / Dashboard Favicon: Location: Dashboard Only Meta tag generated: link rel=”shortcut icon” href=”http://www.yoursite.com/wp-content/favicon.ico” Apple Touch Original / iPhone Icon Location: Website Only iDevice Effects Added such as Gloss and Rounded Corners Meta tag generated: link rel=”apple-touch-icon” href=”http://www.yoursite.com/apple-touch-icon.png” Apple Touch Precomposed / iPhone Icon Location: Website Only No iDevice Effects Added Meta tag generated: link rel=”apple-touch-icon” href=”http://www.yoursite.com/apple-touch-icon.png” Android High Resolution Icon Location: Website Only Meta tag generated: link rel=”icon” href=”http://www.yoursite.com/icon-hires.png” Android Regular Icon Location: Website Only Meta tag generated: link rel=”icon” href=”http://www.yoursite.com/icon-reg.png” If no image links are provided then no code is output thus, leaving a settings field blank will not bloat the site down with empty meta tags. If an Admin image is not provided this option will default to the Site-Wide Favicon. This plugin includes sample files to assist in building the required images. We have included templates for the following: App Touch icons, Regular Favicons, and Android Favicons. These sample images are pre-sized and ready for a creative mind. Open these files in a graphics editor of your choice, make the necessary changes, save them in their appropriate file format and upload them. Plugin URL Multicons Screenshots View Screenshots

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C