WP Manifestindependent plugin directory
manifest / editor / rs-font-awesome-5

RS Font Awesome 5 WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

[WordPress Plugin] This plugin enables you to add icons from Font Awesome 5 using a block or shortcode.

★ 2stars
33release downloads
≈10active sites
v1.0.5latest · 2 years ago

Install

Download RS-Font-Awesome-5.zip From the v1.0.5 release on GitHub, May 28, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/radgh/rs-font-awesome-5/releases/download/v1.0.5/RS-Font-Awesome-5.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

RS Font Awesome 5 (WordPress Plugin)

This plugin enables you to add icons from Font Awesome 5. You can include your Font Awesome scripts by using an official kit, by uploading font files, or by deferring to another plugin which already includes them.

Icons can be inserted using the Font Awesome 5 Icon block or the [fa5] shortcode.

This plugin requires Advanced Custom Fields Pro to be installed and active.

Screenshot showing the basic usage of the block

Contributors: radgh
Requires at least: 6.0
Tested up to: 6.5.2
Requires PHP: 8.0
License: GPLv3
License URI: http://www.gnu.org/licenses/gpl-3.0.txt

Getting Started

Before you can start using icons, you need to visit the settings page under Settings > RS Font Awesome 5. Here you can enable the plugin and select which icon styles are available.

Each icon style requires a separate CSS file to be loaded. You can upload the individual .woff2 file for each style directly through WordPress, or you can embed your own kit.

The settings page, showing the style "Regular" has the font file uploaded to WordPress

Block Usage

The block features the following fields:

  • Icon: Search or browse icons using a Select2 dropdown.
  • Style: Choose the style from: regular, solid, light, or duotone (Brands do not support styles)
  • Title: Add a title to show on hover. If empty, the icon will be treated as decorative by adding aria-hidden="true" for accessibility.
  • Color: Choose a color for the icon from colors defined in the theme.json file. If empty, the icon will inherit the text color.
  • Color 2: If duotone style is selected, a second color dropdown appears so you can select both colors.

Preview of the Font Awesome 5 Icon block selecting the User icon with a selected style, title, and color.

Shortcode usage:

The shortcode is flexible and supports the same features as the block.

Attribute Description
Short syntax [fa5 user]
Alternate syntax [fa5 icon="user"]
Icon with title [fa5 user title="My Account"]
Solid icon style [fa5 user style="solid"]
Orange colored icon [fa5 user color="orange"]
Duotone icon, two colors [fa5 user style="duotone" color="blue" color_2="orange"]

In addition, you can use the shortcode [fa] or [icon] as an alias for [fa5], and all methods support using "icon", "name", or "type" as the icon name. This is useful if you are migrating from a different plugin or theme that uses a different shortcode.

Display all icons

You can display a list of all icons using the shortcode: [fa5_icon_list]

There are no settings for this shortcode. Here is a preview of the output:

Preview of the icon list shortcode, showing three rows of icons and the ability to copy the name, shortcode, or html

Supported Version

This plugin supports Font Awesome 5.15.4. All styles are supported, which currently includes:

  • Regular (far)
  • Solid (fas)
  • Brands (fab)
  • Light (fal)
  • Duotone (fad)

Changelog

1.0.5

  • Fixed js error on non-acf pages

1.0.4

  • Added filter to allow WOFF2 and SVG files by extensions and mime type

1.0.3

  • Fixed align center on icons

1.0.2

  • Added a URL option to the block, with an option to open in new tab

1.0.1

  • Added default icon if none is specified

1.0.0

  • Initial release

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.5 latest
May 28, 2024 2 years ago
RS-Font-Awesome-5.zip
10
May 20, 2024 2 years ago
RS-Font-Awesome-5.zip
6
May 7, 2024 2 years ago
rs-font-awesome-5.zip
5
Apr 26, 2024 2 years ago
rs-font-awesome-5.zip
5
Apr 19, 2024 2 years ago
rs-font-awesome-5.zip
2
Apr 19, 2024 2 years ago
rs-font-awesome-5.zip
5

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

RS Font Awesome 5 1.0.5 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.5
Findings
1
Worst severity
medium
Content hash
bf1a20cd8526fbd7136e132a…

Findings

  • medium Author+ stored XSS via unsanitized global SVG uploads

    xss_stored

    RS_Font_Awesome_5_Setup unconditionally adds image/svg+xml to upload_mimes and, on wp_check_filetype_and_ext, forces ext/type back to svg whenever wp_check_filetype() matches the filename. That pair is site-wide (not limited to the ACF WOFF2 file field, which already sets mime_types to woff2) and performs no SVG sanitization. WordPress core omits SVG from default mimes because scripts inside SVG execute when the file is opened as XML. Any user with upload_files (Author, Editor, Administrator; not Subscriber) can therefore place a malicious .svg in wp-content/uploads. The consumer is the static file served as image/svg+xml: a victim who opens the attachment URL (or any object/embed/inline use) runs attacker JavaScript in the site origin, which can issue authenticated same-origin requests as that user. Changelog 1.0.4 added these filters specifically to make extension/mime uploads succeed.

    includes/setup.php:130-161

    Recommendation

    Stop allowing SVG globally; this plugin only needs WOFF2 for the font-file include method. Keep woff2 on upload_mimes if required, but do not re-enable svg. Remove the wp_check_filetype_and_ext branch that blindly trusts a .svg filename (it defeats core real-MIME rejection). If SVG must remain, sanitize with a dedicated library (e.g. enshrined/svg-sanitize) before accept, and restrict the allow-list to the plugin’s own admin upload UI rather than every media-library user.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.