CVE-2021-24637

MEDIUM 5.4CVE-2021-24637 · Published 20/09/2021 · updated 17/06/2026

In short

CVE-2021-24637 is a MEDIUM (CVSS 5.4) vulnerability affecting fonts (fontsplugin).
Chance of exploitation in the next 30 days (EPSS): 0.62%, higher than 50.1% of all vulnerabilities.
Fix: update to 3.0.3 or later.

Package	Affected versions	Patched versions
fonts fontsplugin	`< 3.0.3`	`3.0.3`

Description

The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.

References

wpscan.com/vulnerability/dd2b3f22-5e8b-41cf-bcb8-d2e673e1d21e · Exploit

More vulnerabilities in fonts

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free