CVE-2024-51929
No known patch is available for this vulnerability.
The affected plugin has been removed from the WordPress.org directory (reason: Security Issue), and no patched version is being distributed through the official directory. If you have the affected software installed, you should uninstall or replace it rather than wait for an update.
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in philspectrum Icon Widget icon-widget-with-links allows DOM-Based XSS.This issue affects Icon Widget: from n/a through <= 1.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
DOM-based XSS in WordPress Icon Widget plugin ≤1.1.0 allows attackers to inject scripts via unsanitized input.
Vulnerability
Description
The Icon Widget plugin for WordPress (version ≤1.1.0) contains a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is improper neutralization of user-supplied input during web page generation, specifically within the icon-widget-with-links component. This allows attacker-controlled data to be interpreted as JavaScript within the victim's browser [1].
Exploitation
Prerequisites
Exploitation requires user interaction—a privileged user must click a malicious link, visit a crafted page, or submit a specially formed form. The attack is launched from the frontend, targeting the DOM, and does not require authentication on the part of the attacker. The vulnerability is cataloged in CVE-2024-51929 with a CVSS v3 base score of 6.5 (Medium) [1].
Impact
Successful exploitation allows an attacker to inject arbitrary JavaScript into the website's pages. This can be used to redirect visitors to malicious sites, display unauthorized advertisements, steal session cookies, or perform other client-side attacks. Because the XSS is DOM-based, the malicious payload executes dynamically in the browser and may bypass server-side filters [1].
Mitigation
The vendor has not released a patched version, and users are advised to update the plugin immediately if a security update becomes available. As a workaround, site administrators should review plugin settings and consider disabling the icon-widget-with-links component until a fix is released. This vulnerability is part of a broader trend of mass-exploit campaigns targeting WordPress plugins [1].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: <=1.1.0
Patches
0icon-widget-with-linksThis plugin has been removed from the WordPress.org directory on 2024-11-08 (reason: Security Issue). No patched version is being distributed through the official directory. Users who have it installed should uninstall it.
Source: api.wordpress.org · directory page
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.