漏洞描述
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8↗cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24435↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-24435↗patchstack.comhttps://patchstack.com/database/vulnerability/titan-framework/wordpress-titan-framework-plugin-1-12-1-reflected-cross-site-scripting-xss-vulnerability↗github.comhttps://github.com/ARPSyndicate/cvemon↗