CVE-2021-24977

CVE-2021-24977: Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending

Vendor Unknown
Product Use Any Font | Custom Font Uploader
Weakness CWE-862 · Missing authorization
Published February 28, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues

Key dates

02Disclosure timeline

February 28, 2022 CVE published
August 3, 2024 Record updated