PT-2021-16375 · WordPress · Wp Google Fonts

Jrxnm + 1 · Published 2021-12-06 · Updated 2021-12-06 · CVE-2021-24935

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WP Google Fonts WordPress plugin versions prior to 3.1.5

Description: The issue arises from the failure to escape the googlefont ajax name and googlefont ajax family parameters of the googlefont action AJAX action, leading to Reflected Cross-Site Scripting issues. This action is available to any authenticated user.

Recommendations: For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the googlefont action AJAX action to minimize the risk of exploitation. Avoid using the parameters googlefont ajax name and googlefont ajax family in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24935

Affected Products

Wp Google Fonts

References · 6

• 🔥 https://wpscan.com/vulnerability/53702281-1bd5-4828-b7a4-9f81cf0b6bb6 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24935 · Security Note
• https://plugins.trac.wordpress.org/changeset/2623659 · Patch
• https://t.me/cvenotify/24267 · Telegram Post
• https://t.me/cibsecurity/33389 · Telegram Post