CVE-2021-24935

Name of the Vulnerable Software and Affected Versions: WP Google Fonts WordPress plugin versions prior to 3.1.5

Description: The issue arises from the failure to escape the googlefont ajax name and googlefont ajax family parameters of the googlefont action AJAX action, leading to Reflected Cross-Site Scripting issues. This action is available to any authenticated user.

Recommendations: For versions prior to 3.1.5, update to version 3.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the googlefont action AJAX action to minimize the risk of exploitation. Avoid using the parameters googlefont ajax name and googlefont ajax family in the affected AJAX endpoint until the issue is resolved.