VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

Titan Framework <= (Various Versions) — Reflected Cross-Site Scripting

CVE-2021-24435Published · Updated

Action summary

Titan Framework: Affected: all versionsNo patch available

Awesome Support – WordPress HelpDesk & Support Plugin: Affected: ≤6.0.10Update to 6.0.11 or newer

Кнопка ЮMoney: Affected: <2.4.0Update to 2.4.0 or newer

WP Mobile Menu – The Mobile-Friendly Responsive Menu: Affected: ≤2.8.2.2Update to 2.8.2.3 or newer

Station Pro – Advanced Audio Streaming & Player for WordPress: Affected: 2.2.1 – 2.2.1Update to 2.2.2 or newer

W3SCloud Contact Form 7 to Zoho CRM: Affected: <2.1.0Update to 2.1.0 or newer

WebHotelier for WordPress: Affected: <1.6.1Update to 1.6.1 or newer

Flight Search Widget and Blocks: Affected: all versionsNo patch available

WordPress Form Customizer | CF7 Customizer: Affected: all versionsNo patch available

Ad Blocker Notify Lite: Affected: all versionsNo patch available

Simple Behance Portfolio: Affected: all versionsNo patch available

Events Shortcodes For The Events Calendar: Affected: <1.7.2Update to 1.7.2 or newer

Border Loading Bar: Affected: all versionsNo patch available

AMP extensions: Affected: all versionsNo patch available

Venture Event Manager: Affected: <3.2.5Update to 3.2.5 or newer

Stars Menu: Affected: all versionsNo patch available

Disable Image Right Click: Affected: all versionsNo patch available

SEO-Dashboard by gutewebsites.de: Affected: all versionsNo patch available

Icons with Links Widget: Affected: all versionsNo patch available

Request Quote via Whatsapp for Woocommerce: Affected: all versionsNo patch available

Woosaleskit Bar: Affected: all versionsNo patch available

TR Easy Google Analytics: Affected: all versionsNo patch available

Media Mirror: Affected: all versionsNo patch available

Custom Scrollbar Designer: Affected: all versionsNo patch available

Popup Modal For Youtube: Affected: all versionsNo patch available

Facebook Page Feed Timeline: Affected: all versionsNo patch available

Exit Popup Show: Affected: all versionsNo patch available

Custom Text Selection Colors: Affected: all versionsNo patch available

Easy Google Map: Affected: all versionsNo patch available

Seatgeek Affiliate Tickets: Affected: all versionsNo patch available

Live Chat for Fanpage: Affected: ≤3.1.0Update to 3.1.1 or newer

Product Limited Time Availability Date for woocommerce: Affected: all versionsNo patch available

Share Posts To Email: Affected: all versionsNo patch available

Easy Gallery Slideshow: Affected: all versionsNo patch available

Sticky Related Posts: Affected: all versionsNo patch available

ICustomizer: Affected: ≤1.4.13Update to 1.5.0 or newer

Catchers Helpdesk and Ticket system for Support: Affected: all versionsNo patch available

Woocommerce Categories in gallery format: Affected: all versionsNo patch available

Bootstrap Categories Gallery: Affected: all versionsNo patch available

Total Sales For Woocommerce: Affected: all versionsNo patch available

Share Woocommerce to Email: Affected: all versionsNo patch available

betteroptin: Affected: all versionsNo patch available

Project2App – Turn Your WordPress Site into an Android App: Affected: all versionsNo patch available

Aoi Tori: Affected: all versionsNo patch available

Easy Justified Gallery – Photo Gallery Block with Lightbox: Affected: ≤1.1Update to 1.1.1 or newer

ClinicalWP Core: Affected: all versionsNo patch available

4k-icon-fonts-for-visual-composer: Affected: all versionsNo patch available

tcS3: Affected: all versionsNo patch available

affiliate-pro: Affected: all versionsNo patch available

What to do until a fix ships
Watch plugin
Severity
Medium6.1
CVSS
6.1
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:N Privileges required
None
UI:R User interaction
Required
S:C Scope
Changed
C:L Confidentiality
Low
I:L Integrity
Low
A:N Availability
None
Weakness
CWE-79 Cross-Site Scripting
Required access
No account needed
Exploit prediction (EPSS)
No score
CISA KEV
Not listed
On this page8

Am I affected?

Titan Framework titan-framework

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Awesome Support – WordPress HelpDesk & Support Plugin awesome-support

  1. Affected≤ 6.0.10
  2. Patched in6.0.11

Update to 6.0.11 or newer.

You are affected if you run ≤ 6.0.10. Version 6.0.11 and later are not affected by this issue.

Кнопка ЮMoney yandex-money-button

  1. Affected< 2.4.0
  2. Patched in2.4.0

Update to 2.4.0 or newer.

You are affected if you run < 2.4.0. Version 2.4.0 and later are not affected by this issue.

WP Mobile Menu – The Mobile-Friendly Responsive Menu mobile-menu

  1. Affected≤ 2.8.2.2
  2. Patched in2.8.2.3

Update to 2.8.2.3 or newer.

You are affected if you run ≤ 2.8.2.2. Version 2.8.2.3 and later are not affected by this issue.

Station Pro – Advanced Audio Streaming & Player for WordPress station-pro

  1. Affected2.2.1 – 2.2.1
  2. Patched in2.2.2

Update to 2.2.2 or newer.

You are affected if you run 2.2.1 – 2.2.1. Version 2.2.2 and later are not affected by this issue.

W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho

  1. Affected< 2.1.0
  2. Patched in2.1.0

Update to 2.1.0 or newer.

You are affected if you run < 2.1.0. Version 2.1.0 and later are not affected by this issue.

WebHotelier for WordPress webhotelier

  1. Affected< 1.6.1
  2. Patched in1.6.1

Update to 1.6.1 or newer.

You are affected if you run < 1.6.1. Version 1.6.1 and later are not affected by this issue.

Flight Search Widget and Blocks flight-search-widget-blocks

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

WordPress Form Customizer | CF7 Customizer cf7-customizer

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Ad Blocker Notify Lite adblock-notify-by-bweb

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Simple Behance Portfolio simple-behace-portfolio

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Events Shortcodes For The Events Calendar template-events-calendar

  1. Affected< 1.7.2
  2. Patched in1.7.2

Update to 1.7.2 or newer.

You are affected if you run < 1.7.2. Version 1.7.2 and later are not affected by this issue.

Border Loading Bar border-loading-bar

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

AMP extensions amp-extensions

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Venture Event Manager venture-event-manager

  1. Affected< 3.2.5
  2. Patched in3.2.5

Update to 3.2.5 or newer.

You are affected if you run < 3.2.5. Version 3.2.5 and later are not affected by this issue.

Stars Menu stars-menu

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Disable Image Right Click disable-image-right-click

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

SEO-Dashboard by gutewebsites.de seo-dashboard-by-gutewebsites-de

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Icons with Links Widget icons-with-links-widget

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Request Quote via Whatsapp for Woocommerce woo-whatsapp-request-quote

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Woosaleskit Bar woosaleskit-bar

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

TR Easy Google Analytics tr-easy-google-analytics

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Media Mirror media-mirror

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Custom Scrollbar Designer custom-scroll-bar-designer

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Popup Modal For Youtube popup-modal-for-youtube

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Facebook Page Feed Timeline cool-facebook-page-feed-timeline

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Exit Popup Show exit-popup-show

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Custom Text Selection Colors custom-text-selection-colors

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Easy Google Map easy-google-map

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Seatgeek Affiliate Tickets seatgeek-affiliate-tickets

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Live Chat for Fanpage live-chat-facebook-fanpage

  1. Affected≤ 3.1.0
  2. Patched in3.1.1

Update to 3.1.1 or newer.

You are affected if you run ≤ 3.1.0. Version 3.1.1 and later are not affected by this issue.

Product Limited Time Availability Date for woocommerce woo-availability-date

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Share Posts To Email email-my-posts

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Easy Gallery Slideshow easy-gallery-slideshow

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Sticky Related Posts sticky-related-posts

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

ICustomizer icustomizer

  1. Affected≤ 1.4.13
  2. Patched in1.5.0

Update to 1.5.0 or newer.

You are affected if you run ≤ 1.4.13. Version 1.5.0 and later are not affected by this issue.

Catchers Helpdesk and Ticket system for Support catchers-helpdesk

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Woocommerce Categories in gallery format categories-gallery-woocommerce

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Bootstrap Categories Gallery categories-gallery

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Total Sales For Woocommerce total-sales-for-woocommerce

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Share Woocommerce to Email share-woocommerce-email

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

betteroptin betteroptin

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Project2App – Turn Your WordPress Site into an Android App project-app

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Aoi Tori aoi-tori

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

Easy Justified Gallery – Photo Gallery Block with Lightbox easy-justified-gallery

  1. Affected≤ 1.1
  2. Patched in1.1.1

Update to 1.1.1 or newer.

You are affected if you run ≤ 1.1. Version 1.1.1 and later are not affected by this issue.

ClinicalWP Core clinicalwp-core

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

4k-icon-fonts-for-visual-composer 4k-icon-fonts-for-visual-composer

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

tcS3 tcs3

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

affiliate-pro affiliate-pro

  1. Affectedall versions
  2. PatchedNo fix yet

No patched version available.

You are affected if you run all versions. No fixed version has been released.

  • Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Titan Framework.
  • No admin access? Run a passive check of your site. It reads public files only.
  • No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

  1. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  2. Update to version 6.0.11, or a newer patched version
  3. Update to version 2.4.0, or a newer patched version
  4. Update to version 2.8.2.3, or a newer patched version
  5. Update to version 2.2.2, or a newer patched version
  6. Update to version 2.1.0, or a newer patched version
  7. Update to version 1.6.1, or a newer patched version
  8. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  9. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  10. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  11. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  12. Update to version 1.7.2, or a newer patched version
  13. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  14. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  15. Update to version 3.2.5, or a newer patched version
  16. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  17. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  18. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  19. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  20. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  21. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  22. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  23. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  24. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  25. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  26. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  27. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  28. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  29. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  30. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  31. Update to version 3.1.1, or a newer patched version
  32. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  33. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  34. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  35. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  36. Update to version 1.5.0, or a newer patched version
  37. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  38. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  39. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  40. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  41. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  42. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  43. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  44. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  45. Update to version 1.1.1, or a newer patched version
  46. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  47. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  48. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  49. No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
  50. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
  51. Watch Titan Framework to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to iohex.

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

More in Titan Framework

All 2
More vulnerabilities in Titan Framework
SeverityVulnerabilityCVEPublished
Medium6.1Reflected Cross-Site Scripting
<1.6Update to 1.6
CVE-2014-6444

Same weakness (Cross-Site Scripting)

All Cross-Site Scripting
Other Cross-Site Scripting vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup≤5.25.25Update to 5.26.45
CVE-2026-120688
Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder≤1.0.2Update to 1.1
CVE-2026-125055
Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
ELEX WordPress HelpDesk & Customer Ticketing System≤3.3.9Update to 3.4.0
CVE-2026-119077
Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
Customer Reviews for WooCommerce≤5.127.0Update to 5.128.0
CVE-2026-121518

Timeline

  1. CVE published

    Severity medium, CVSS 6.1

  2. Record last updated

Sources & licenses

Wordfence record
Vulnerability data
Wordfence Intelligence. [object Object] Licensed under the CC BY-SA 4.0.
CVE® identifiers
[object Object]. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
VulnCrest content
Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?