CVE-2021-24435: Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-06 · updated 2026-06-17
Weakness: CWE-79

Description

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues

Affected products

Titan Framework: through 1.12.1

References

https://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8
https://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8

Get alerted when CVE-2021-24435 or the next vulnerability affects your stack