CVE-2021-24935: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24935 affects the WP Google Fonts WordPress plugin versions below 3.1.5. This is a Reflected Cross-Site Scripting (XSS) vulnerability discovered and reported by ZhongFu Su(JrXnm) of Wuhan University. The vulnerability was publicly disclosed on November 3, 2021 (WPScan).

The vulnerability exists because the plugin fails to properly escape the 'googlefont_ajax_name' and 'googlefont_ajax_family' parameters in the 'googlefont_action' AJAX action. This vulnerability is accessible to any authenticated user and has been assigned a CVSS score of 6.1 (medium severity). The vulnerability is classified as CWE-79: Cross-Site Scripting and falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

When exploited, the XSS vulnerability can be triggered in two ways: the XSS from the googlefont_ajax_name parameter is triggered when the mouse hovers over any checkbox, while the googlefont_ajax_family parameter triggers the XSS only in sections 1 and 4 (WPScan).

The vulnerability has been fixed in version 3.1.5 of the WP Google Fonts plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).