Input validation vulnerability in Fonto – Custom Web Fonts Manager 1.2.1

The Fonto plugin for WordPress, which helps manage custom web fonts, has a security issue that allows attackers to inject harmful code onto web pages. This can happen when uploading SVG files and affects all versions up to 1.2.1. The plugin does not properly clean or protect the input and output of the files, making it possible for attackers with Author-level access or higher to execute their own code whenever someone opens an SVG file on the website.

Detected in:

Fonto – Custom Web Fonts Manager open vulnerable versions: >= * <= 1.2.1

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

Is this information incorrect? Please leave us a message.