CVE-2021-24977

MEDIUM

Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Injection and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/739831e3-cdfb-4a22-9abf-6c594d7e3d75

Scores

CVSS v3 6.1
EPSS 0.0147
EPSS Percentile 70.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-862
Status published
Products (1)
dineshkarki/use_any_font < 6.2.1
Published Feb 28, 2022
Tracked Since Feb 18, 2026