WordPress Plugin Vulnerabilities
Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting
Description
The plugin does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
Add a new font (Tools --> Local Fonts --> Add Font, need to have at least one font for the 'Add Font' to show up), put the following payload in the Class Name field (will trigger a self-XSS): <script>alert(/XSS/)</script> and save the change. The XSS will be triggered on the plugin's settings page (/wp-admin/tools.php?page=fsflex-local-fonts)
Affects Plugins
No known fix References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Vishal Mohan
Submitter
Vishal Mohan
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-11-15 (about 2 years ago)
Added
2021-11-15 (about 2 years ago)
Last Updated
2022-04-13 (about 2 years ago)
WPScan 