Description
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Titan Framework | 1.12.1 – ≤ 1.12.1 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting http/cves/2021/CVE-2021-24435.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.