Titan Framework Vulnerabilities

[en] The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues

Affected:

up to 1.12.1

Fix:

No patched version reported

Disclosed:

Sep 6, 2021

CVE-2021-24435 on NVD →

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues.

CVSS:

6.1

Affected:

up to *

Fix:

No patched version reported

Disclosed:

Aug 9, 2021

CVE-2021-24435 on NVD →

[en] Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to iframe-googlefont-preview.php or the (2) text parameter to iframe-font-preview.php.

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Jan 8, 2016

CVE-2014-6444 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to iframe-googlefont-preview.php or the (2) text parameter to iframe-font-preview.php.

CVSS:

6.1

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Oct 7, 2014

CVE-2014-6444 on NVD →