Stored Cross-Site Scripting (XSS) Vulnerability in Fonto Custom Web Fonts Manager

CVE-2024-8920

What is CVE-2024-8920?

The Fonto - Custom Web Fonts Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. Authenticated attackers with Author-level permissions and higher can exploit this weakness by uploading SVG files containing hostile scripts. These scripts will execute when users access the affected SVG files, posing a significant security risk to the site and its visitors. Appropriate security measures and updates are crucial to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References