CVE-2024-1332 is a stored cross-site scripting vulnerability in the brainstormforce Custom Fonts – Host Your Fonts Locally WordPress plugin. The issue arises from improper validation and escaping of SVG file uploads, enabling authenticated users with author-level or higher permissions to inject malicious scripts. These scripts execute in the context of any user viewing the injected page, potentially compromising user sessions or performing unauthorized actions. The vulnerability affects all plugin versions up to and including 2.1.4.

Successful exploitation allows an authenticated attacker with author-level access to inject persistent malicious scripts via SVG uploads. This can lead to client-side script execution in the browsers of users who view the compromised pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability and requires user interaction to trigger the script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user permissions to trusted individuals only and consider disabling SVG uploads if possible. Monitor for plugin updates from brainstormforce and apply them promptly once released to address this vulnerability.