CVE-2024-1332: 
WordPress vulnerability analysis and mitigation

The Custom Fonts – Host Your Fonts Locally WordPress plugin contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1332) in versions up to and including 2.1.4. The vulnerability stems from insufficient input sanitization and output escaping when handling svg file uploads (CVE Details).

The vulnerability allows authenticated users with author-level permissions or higher to inject arbitrary web scripts through svg file uploads. These malicious scripts will execute whenever a user accesses the compromised page. The vulnerability exists due to inadequate input validation and output escaping mechanisms in the plugin (CVE Details).

When exploited, this vulnerability enables attackers to inject and execute malicious web scripts that run in users' browsers when they visit affected pages. This could lead to session hijacking, credential theft, or other client-side attacks against site visitors (CVE Details).

The vulnerability requires an authenticated account with author-level permissions or higher to exploit. While this requirement somewhat limits the scope of potential attackers, many WordPress sites have multiple users with such access levels, making this a significant security concern (CVE Details).

Site administrators should update the Custom Fonts plugin to a version newer than 2.1.4 as soon as possible. If immediate updating is not possible, consider temporarily disabling the plugin or restricting access to user roles that can upload files (CVE Details).