Vulnerability · Published Sep 6, 2021 · Assigned by WPScan
CVE-2021-24435Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Medium 6.1
In plain English
A medium-severity cross-site scripting in Titan Framework from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.7%top 22.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Titan Framework | 1.12.1 – through 1.12.1 |
Weakness: CWE-79