WordPress Category Icon Plugin XML External Entity (XXE) Vulnerability

A vulnerability allowing XML External Entity (XXE) injection has been identified in the WordPress Category Icon plugin, specifically in versions through 1.0.2. This vulnerability arises from improper restriction of XML external entity references, which could be exploited to link XML entities and potentially inject arbitrary XML.

Impact

Exploitation of this vulnerability could lead to XML entity linking, allowing for the injection of arbitrary XML. This could cause the website to leak sensitive information, experience a denial of service, or suffer from server-side request forgery.