Medium · 6.8 CVE-2023-24416 EUVD-2023-28472GHSA-hfqr-7mcf-f22q

WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion

Published Feb 23, 2024 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Arne Franken Product: All In One Favicon

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7.

Affected products

Vendor	Product	Affected	Fixed
Arne Franken	All In One Favicon	≤ 4.7	—

References

https://patchstack.com/database/vulnerability/all-in-one-favicon/wordpress-all-in-one-favicon-plugin-4-7-arbitrary-file-deletion-vulnerability?_s_id=cve vdb-entry