WordPress Plugin Vulnerabilities

Google Fonts For WordPress < 3.0.1 - Reflected XSS

Description

The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affects Plugins

Plugin icon
free-google-fonts
Fixed in 3.0.1

References

CVE
CVE-2023-34180

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Le Ngoc Anh
Verified
No
WPVDB ID
18a74d98-3ecc-4a0d-829b-fab7411daf8d

Timeline

Publicly Published
2023-05-30 (about 11 months ago)
Added
2023-08-31 (about 8 months ago)
Last Updated
2023-08-31 (about 8 months ago)

Other

Published
Title
Published
2023-11-20
Title
Parallax Image < 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-07-21
Title
Digital Publications by Supsystic < 1.7.4 - Admin+ Stored Cross-Site Scripting
Published
2024-04-05
Title
Form to Chat App < 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-09-13
Title
Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting
Published
2020-03-02
Title
Testimonial < 2.1.7 - Authenticated Stored Cross-Site Scripting (XSS)