EUVD-2026-94489
GHSA-fr3h-jj72-vm96
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a reflected cross-site scripting (CWE-79) flaw in a WordPress plugin, rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity, and no required privileges (PR:N) make it remotely reachable by unauthenticated attackers, but UI:R means a victim must be social-engineered into clicking a crafted link, which meaningfully caps automatability and rules out worm-like mass exploitation. The elevated score is driven largely by the scope change (S:C), reflecting that injected script executes in the victim's browser context rather than a true server-side compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis - this is best treated as a moderate, patch-in-normal-cycle issue rather than an emergency. Real-world risk is conditional on an attacker successfully delivering the malicious link to a user of an affected site; the impact ceiling is session/credential theft or admin-context actions against a WordPress user who follows the link, not unauthenticated server takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
RemediationAI
No vendor-released patch version is identified in the available data; the affected range extends through 2.0.2, so administrators should check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/disable-remove-google-fonts/vulnerability/wordpress-disable-and-remove-google-fonts-gdpr-dsgvo-friendly-plugin-2-0-2-cross-site-scripting-xss-vulnerability) and the WordPress.org plugin page for a patched release and upgrade to it as soon as it is published, verifying the fixed version number rather than assuming one. If no fix is yet available, actionable mitigations are: deactivate and remove the plugin if Google Fonts handling is not required, accepting the loss of its GDPR/DSGVO font-blocking behaviour (which may matter for site compliance, so substitute an alternative font-localization approach); place a web application firewall or reverse-proxy rule in front of the site that rejects or sanitizes requests carrying script payloads in query strings and parameters handled by the plugin, noting that signature-based WAF rules can be bypassed with encoding tricks; deploy a Content-Security-Policy that disallows inline and untrusted script sources to blunt successful injection, understanding that strict CSP can break legitimate theme and plugin scripts; and restrict exposure by reviewing which public endpoints the plugin registers and blocking unused ones at the server, at the cost of debugging complexity. Until a fixed version is confirmed installed, treat any link or parameter originating from the plugin's request handling as untrusted, and monitor site logs for reflected-payload probes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, in a WordPress plugin distributed under the fontsplugin vendor namespace (CPE: cpe:2.3:a:fontsplugin:disable_and_remove_google_fonts_|_gdpr_&_dsgvo_friendly:*:*:*:*:*:*:*:*). The plugin's purpose is to stop WordPress sites from loading Google-hosted fonts, so it processes configuration and request parameters that influence the HTML and asset URLs emitted to visitors; when attacker-controlled input from a request is echoed back into the rendered page without output encoding or contextual escaping, the browser parses it as script rather than data. The CVSS vector's Scope:Changed (S:C) component is typical of XSS, because the vulnerable component (the plugin/server response) is exploited to affect a different security authority - the victim's browser origin - enabling session theft, credential phishing, or arbitrary actions as the victim. The vector's low confidentiality, integrity, and availability impacts (C:L/I:L/A:L) reflect the limited but real consequences of script execution in a single victim's session rather than server compromise.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS.
This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly: from n/a through 2.0.2.
Executive ViewAI
Organizations using the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' (versions up to 2.0.2) are exposed to a reflected cross-site scripting vulnerability that could allow attackers to execute malicious scripts in visitors' browsers. Although no public exploit identified at time of analysis and exploitation requires a victim to click a crafted link, successful attacks could compromise user sessions, lead to data theft, or damage site reputation, with potential regulatory implications under GDPR. Leadership should prioritize remediation given the plugin's GDPR-focused user base and the absence of a vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling the affected plugin, deploying WAF rules to filter XSS attempts, implementing Content Security Policy (CSP), and monitoring for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB