Favicon by RealFaviconGenerator

Creates and installs favicons optimized for multiple platforms including Windows, macOS, iOS, Android, and tablets. With over 200,000 active installations and a 4.9/5 rating, this tool ranks in the top 1% of WordPress plugins.

Generated on 8 Jul 2026. Score and stats mentioned may differ from current live data.

#120 Global Rank

200K+ active installs

4.9/5 801 ratings

Since 2014 12 years active

Vulnerabilities

4 Total

4 Patched

0 Active

100% Resolved rate

Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Favicon by RealFaviconGenerator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

7.2 High Affected All – 1.3.46 Patched in ✓ 1.3.47 Published 30 May 2026 CVE CVE-2026-42754

Favicon by RealFaviconGenerator <= 1.3.22 - Reflected Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue

6.1 Medium Affected All – 1.3.23 Patched in ✓ 1.3.23 Published 21 Mar 2022 CVE CVE-2022-0471

Favicon by RealFaviconGenerator <= 1.3.21 - Reflected Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.

6.1 Medium Affected All – 1.3.21 Patched in ✓ 1.3.21 Published 27 Jul 2021 CVE CVE-2021-24437

Favicon by RealFaviconGenerator <= 1.2.12 - Reflected Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Favicon by RealFaviconGenerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘json_result_url’ parameter in versions before 1.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

7.1 High Affected All – 1.2.13 Patched in ✓ 1.2.13 Published 1 Apr 2015 CVE CVE-2015-10116

About Favicon by RealFaviconGenerator

Create and install your favicon for all platforms: PC/Mac, iPhone/iPad, Android devices, Windows 8 tablets...

Generate and setup a favicon for desktop browsers, iPhone/iPad, Android devices, Windows 8 tablets and more. In a matter of seconds, design an icon that looks great on all major platforms.

Favicon is not just a single favicon.ico file dropped in the middle of your site. Nowadays, with so many different platforms and devices, you need a bunch of pictures to get the job done. With RealFaviconGenerator, generate all the icons you need for desktop browsers, iPhone/iPad, Android devices, Windows 8 devices, and more.

iOS devices use a high resolution Apple touch icon to illustrate bookmarks and home screen shortcuts. A first generation iPhone needs a 57×57 picture, whereas a brand new iPad with Retina screen looks for a 152×152 picture. Android Chrome also use these pictures if it finds them. Windows 8 takes another route with a dedicated set of icons and HTML declarations.

Favicon is not only a matter of pictures with different resolutions. The various platforms coms with different UI guidelines. For example, the classic desktop favicons often use transparency. But iOS requires opaque icons. And Windows 8 has its own recommendations.

Save hours of research and image edition with RealFaviconGenerator and its companion plugin. In a matter of seconds, you setup a favicon compatible with:

Windows (IE, Chrome, Firefox, Opera, Safari)
Mac (Safari, Chrome, Firefox, Opera, Camino)
iOS (Safari, Chrome, Coast)
Android (Chrome, Firefox)
Surface (IE)
And more

We take compatibility very seriously. See http://realfavicongenerator.net/favicon_compatibility for the full list.

This plugin relies on RealFaviconGenerator when you create your favicon. Browse its terms of service and privacy policy for additional information.

Localization

English (en_EN) by Philippe Bernard
French (fr_FR) by Philippe Bernard
Swedish (sv_SE) by Linus Wileryd
Brazilian Portuguese (pt_BR) by Marcelo Volgarini, Criação de Sites
Dutch (nl_NL) by Axel Vanderhaeghen
Danish (da_DK) by Alexander Leo-Hansen
Czech (cs_CZ) by an anonymous translator
Polish (pl_PL) by Maciej Gryniuk
Russian (ru_RU) by Natasha Diatko, UStarCash
Indonesian (id_ID) by Jordan Silaen

Screenshots

Initial favicon setup screen. You are invited to setup your favicon.

Select a master picture from the Media Library (optional)

Once you hit the Generate Favicon button, you are redirected to RealFaviconGenerator, where you can design your favicon: adding a background to your iOS picture, using a saturated version of your master picture for Windows 8...

When you are done with the favicon editor, you are redirected to the WordPress Dashboard. The favicon is installed automatically. This screen presents you a preview of the favicon you various platforms, so you know how your blog looks like on various platforms.

You can also trigger RealFaviconGenerator's favicon checker, to make sure your favicon is correctly setup.

Changelog

1.3.50

Plugin was tested up to WordPress 7.1

1.3.49

Plugin was tested up to WordPress 7.0.1

1.3.48

Code improvements (reported by Plugin Check)

1.3.47

Improved security regarding RealFaviconGenerator callback. See https://patchstack.com/database/report-preview/6ac6f776-ca92-4e0b-b397-6c05f16665d4

1.3.46

Plugin was tested up to WordPress 7.0

1.3.45

Plugin was tested up to WordPress 6.9.1

1.3.44

Plugin was tested up to WordPress 6.9

1.3.43

Plugin was tested up to WordPress 6.8.3

1.3.42

Plugin was tested up to WordPress 6.8.2

1.3.41

Plugin was tested up to WordPress 6.8.1

1.3.40

Fix regarding previous version

1.3.39

Plugin was tested up to WordPress 6.8

1.3.38

Plugin was tested up to WordPress 6.7.2

1.3.37

Plugin was tested up to WordPress 6.7.1

1.3.36

Plugin was tested up to WordPress 6.7

1.3.35

Set a greater timeout when downloading a file from RealFaviconGenerator website

1.3.34

Plugin was tested up to WordPress 6.6.2

1.3.33

Update plugin tags

1.3.32

Missing WordPress version in the previous release

1.3.31

Plugin was tested up to WordPress 6.6.1

1.3.30

Improved security regarding settings update. See https://patchstack.com/database/report-preview/fcd95d9c-460c-4b14-aa5d-9afd321913e4?pin=Xc15v7wlzcKolpp4

1.3.29

Plugin was tested up to WordPress 6.4.3

1.3.28

Plugin was tested up to WordPress 6.3.2

1.3.27

Plugin was tested up to WordPress 6.1.1 – Previous tag was wrongly set

1.3.26

Plugin was tested up to WordPress 6.1.1

1.3.25

Escape favicon HTML
URL sanitization

1.3.24

Security audit
Plugin was tested up to WordPress 5.9.3

1.3.23

Fix reflected cross-site scripting issue
Plugin was tested up to WordPress 5.9.2

1.3.22

Fix inconsistency in previous deploy

1.3.21

Plugin was tested up to WordPress 5.8
Fix XSS security issue, reported by WPSpan.com. See https://wpscan.com/vulnerability/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9?fbclid=IwAR2aRMXRjbGm9ppoI9tM-OHm26Q0ax4yt0MkcP5sp0-pz9D4eVIEHQwvG1Y

1.3.20

Fix: media selection works again
Plugin was tested up to WordPress 5.6

1.3.19

Plugin was tested up to WordPress 5.5.3

1.3.18

Remove reference to deprecated function screen_icon
Plugin was tested up to WordPress 5.4

1.3.17

Changes to clear security warnings from CodeRisk

1.3.16

Plugin was tested up to WordPress 5.3.2

1.3.15

Plugin was tested up to WordPress 5.1

1.3.14

Plugin was tested up to WordPress 5.0-beta5

1.3.13

Plugin was tested up to WordPress 4.9.7

1.3.12

Never published, no change

1.3.11

id/ID translation added, thanks to Jordan Silaen
Plugin was tested up to WordPress 4.8.1

1.3.10

Always access RealFaviconGenerator via HTTPS
Clarification in local path separators for Windows
Plugin was tested up to WordPress 4.7.1
Notice to ask administrator to not deactivate the plugin

1.3.9

Plugin was tested up to WordPress 4.7

1.3.8

Plugin was tested up to WordPress 4.6

1.3.7

Fix: Plugin keywords rephrased (some were not taken into account).

1.3.6

Fix: the icons path was sometimes wrong when the upload directory was the root directory

1.3.5

pl/PL translation added, thanks to Maciej Gryniuk
ru/RU translation added, thanks to Natasha Diatko

1.3.4

Plugin was tested up to WordPress 4.5

1.3.3

Deactivate debug logs

1.3.2

Typos in French translations
Warning fix for PHP7
Tested up to WordPress 4.4.1
cs/CZ translation added, thanks to an anonymous translator

1.3.1

Hotfix in previous version.

1.3.0

The plugin takes advantage of RealFaviconGenerator’s non-interactive API to upgrade the favicon automatically whenever a new version is available.

1.2.15

Donation link added.
Plugin now works when access to file system is via FTP (not direct). See https://wordpress.org/support/topic/no-images-created

1.2.14

Security improvement.
Warning fix regarding NONCE_ACTION_NAME.
Useless PHP closing tags removed.
Error checking added to favicon package unzipping.

1.2.13

XSS vulnerability fixed, reported by Kacper Szurek

1.2.12

Performance improvements: favicon update checking is now done in the Admin section (not the Public section), locales are not loaded in the Public section anymore.
Take advantage of the Rewrite API (when available) to make the files appear to be in the root directory. So http://example.com/favicon.ico works (eg. when requested by Yandex).
nl/NL translation added, thanks to Axel Vanderhaeghen.

1.2.11

When the admin’s browser cannot get the picture selected from the Media Library, the UI fails gracefully.
Favicon package unzipping is more robust.
Notice to ask users to rank the plugin on WordPress.org.

1.2.10

Warning fix when used with BuddyPress (bp_setup_current_user). See https://wordpress.org/support/topic/wp_debug-notice-for-bp_setup_current_user.

1.2.9

When selected from the Media Library, the master picture is now retrieved by WP administrator’s browser to prevent several issues (locally hosted blogs, blogs protected in a way or another, etc.).

1.2.8

Plugin successfully tested against WordPress 4.1.

1.2.7

Fix for WordPress sites hosted on Windows.

1.2.6

The plugin is now compatible with multisite.

1.2.5

Fix for login page: favicon code was not injected in this particular page.

1.2.4

Remove debug messages to avoid false positives in error log.

1.2.3

Update notifications can be dismissed once for all.
New Settings page to enable/disable update notifications.

1.2.2

Fix for the 403 issue with HostGator hosting service (https://wordpress.org/support/topic/403-error-when-generating-favicon).

1.2.1

Fix in plugin removal and update checking.

1.2.0

The plugin now warns the user when RealFaviconGenerator was updated and the favicon should be generated again.

1.1.1

Rewrite API usage disabled. Favicon files do not appear to be in the root directory of the blog anymore.

1.1.0

Run RealFaviconGenerator’s favicon checker from the admin interface.

1.0.7

Deactivate default Genesis favicon when one is configured in FbRFG.

1.0.6

Error management improved during favicon install.

1.0.5

Do not try to rewrite the favicon files URL when .htaccess is not writable.

1.0.4

Option to not rewrite the favicon files URL, even when this is possible.

1.0.3

Plugin code syntax changed to fit older versions of PHP.

1.0.2

Callback URL was too long for some servers. It has been shorten.

1.0.1

Favicon admin settings are now in the Appearance menu.
Fix in favicon package download.
Fix in error management during favicon installation.

1.0

Initial version.

Alternatives to Favicon by RealFaviconGenerator

Other WordPress plugins serving a similar purpose, ranked by relevance and PF Score.

Silver63.5

Multicons

Multicons is a multi-favicon code generator which automatically inserts the necessary meta tags for favicons.

★ 5/5·2K+ installs·Updated 5 Dec 2025

Gold76.4

✩

Favicon Rotator

Set and rotate multiple favicons to customize how your site appears in browser tabs and bookmarks.

★ 4.3/5·20K+ installs·Updated 18 Jun 2026

Silver66.6

Custom Favicon

Easily add a custom favicon and Apple touch icon to your WordPress site, including support for dark mode, SVG icons,…

★ 5/5·5K+ installs·Updated 25 Jul 2025

Silver66.0

Site Favicon

Add a favicon.

★ 3.8/5·5K+ installs·Updated 21 Jan 2026

Silver58.6

Forma Favicon

Favicon generator — upload a source, customize styling, and generate all required favicon sizes including ICO, Apple Touch, and Android…

200+ installs·Updated 7 May 2026

Platinum86.4

Font Awesome

Official plugin to embed Font Awesome Free or Pro icons on WordPress sites using SVG or webfont delivery.

★ 3.6/5·400K+ installs·Updated 13 Aug 2026

Gold79.2

The Icon Block

Add SVG icons and graphics to the WordPress block editor with a dedicated icon block.

★ 5/5·40K+ installs·Updated 18 Jan 2026

Gold77.6

Mobile Contact Bar

Floating mobile contact bar with call buttons, messaging, and quick site navigation options.

★ 4.6/5·10K+ installs·Updated 15 Jun 2026

Gold76.0

Custom Login

Custom Login allows you to easily customize your admin login page, works great for client sites!

★ 3.6/5·10K+ installs·Updated 13 Aug 2026

Gold76.0

Icon Element

Icon packs designed for use within the Elementor page builder interface.

★ 4.4/5·40K+ installs·Updated 24 Apr 2026

Gold76.0

✩

Multi Device Switcher

Serve different themes to visitors based on device type detected.

★ 4.3/5·20K+ installs·Updated 3 Jun 2026

Gold75.7

SVG Block

Display an SVG image as a block, which can be used for displaying images, icons, dividers, buttons

★ 5/5·4K+ installs·Updated 16 Aug 2026

Favicon by RealFaviconGenerator

PF Score (About PF Scores)

Score Breakdown

Download Trends

Vulnerabilities

Support Statistics

About Favicon by RealFaviconGenerator

Localization

Screenshots

Ratings & Reviews

Recent Reviews

Changelog

1.3.50

1.3.49

1.3.48

1.3.47

1.3.46

1.3.45

1.3.44

1.3.43

1.3.42

1.3.41

1.3.40

1.3.39

1.3.38

1.3.37

1.3.36

1.3.35

1.3.34

1.3.33

1.3.32

1.3.31

1.3.30

1.3.29

1.3.28

1.3.27

1.3.26

1.3.25

1.3.24

1.3.23

1.3.22

1.3.21

1.3.20

1.3.19

1.3.18

1.3.17

1.3.16

1.3.15

1.3.14

1.3.13

1.3.12

1.3.11

1.3.10

1.3.9

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.15

1.2.14

1.2.13

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.1