Stored Cross-Site Scripting (XSS) Vulnerability in Fonto Custom Web Fonts Manager

CVE-2024-8920

What is CVE-2024-8920?

The Fonto - Custom Web Fonts Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. Authenticated attackers with Author-level permissions and higher can exploit this weakness by uploading SVG files containing hostile scripts. These scripts will execute when users access the affected SVG files, posing a significant security risk to the site and its visitors. Appropriate security measures and updates are crucial to mitigate this risk.

References