CVE-2021-24637: Fonts Plugin < 3.0.3 - Contributor+ Stored Cross-Site Scripting
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24637?
CVE-2021-24637 is rated as a medium severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2021-24637?
To fix CVE-2021-24637, update the Google Fonts Typography WordPress plugin to version 3.0.3 or later.
Who is affected by CVE-2021-24637?
Users with roles as low as Contributor can exploit CVE-2021-24637 if they have access to the Google Fonts Typography WordPress plugin.
What type of attack does CVE-2021-24637 enable?
CVE-2021-24637 enables Stored Cross-Site Scripting (XSS) attacks through insufficient sanitization of user input.
What versions of the Google Fonts Typography plugin are vulnerable to CVE-2021-24637?
Versions of the Google Fonts Typography WordPress plugin prior to 3.0.3 are vulnerable to CVE-2021-24637.