CVE-2026-5725: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in archetyped Favicon Rotator

CVE-2026-5725 is a reflected cross-site scripting vulnerability in the archetyped Favicon Rotator WordPress plugin. The flaw exists due to insufficient input sanitization and output escaping of request parameters prefixed with 'fvrt_'. This allows unauthenticated attackers to inject arbitrary web scripts into pages generated by the plugin. Successful exploitation requires tricking a user into clicking a malicious link, leading to script execution in the user's browser context.

Exploitation of this vulnerability can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the affected website. This may enable actions such as session hijacking, defacement, or redirection to malicious sites. There is no direct impact on availability. The vulnerability affects unauthenticated attackers and requires user interaction.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and consider applying workarounds such as disabling the plugin or restricting access to vulnerable parameters until a fix is available. Avoid clicking on suspicious links that may exploit this vulnerability.