Lucene search

CVE-2024-8920 Fonto – Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

🗓️ 17 Oct 2024 09:17:32Reported by WordfenceType

Fonto Web Fonts Manager CVE-2024-892

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2024-8920 Fonto – Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	17 Oct 202409:32	–	cvelist
Patchstack	WordPress Fonto Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)	16 Oct 202400:00	–	patchstack
CVE	CVE-2024-8920	17 Oct 202410:15	–	cve
NVD	CVE-2024-8920	17 Oct 202410:15	–	nvd
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (October 14, 2024 to October 20, 2024)	24 Oct 202415:33	–	wordfence

[
  {
    "cpes": [
      "cpe:2.3:a:vladolaru:fonto_custom_web_fonts_manager:*:*:*:*:*:*:*:*"
    ],
    "vendor": "vladolaru",
    "product": "fonto_custom_web_fonts_manager",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "1.2.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/fonto/trunk/includes/class-fonto.php
wordpress	www.wordpress.org/plugins/fonto/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/358be91d-cb00-429b-a4ed-69bf81e4d19e
plugins	www.plugins.trac.wordpress.org/changeset/3169936/
plugins	www.plugins.trac.wordpress.org/changeset/3169936/

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

17 Oct 2024 09:32Current

5.8Medium risk

Vulners AI Score5.8

CVSS36.4

EPSS0.001

SSVC

CWE-79