Easy Google Fonts
Monthly
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.