Omgf Gdpr Dsgvo Compliant Faster Google Fonts Easy
Monthly
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.