Executive brief
The Easy Google Fonts WordPress plugin fails to properly validate and escape user input in its control_selectors setting, allowing authenticated users with Author-level access or higher to inject malicious JavaScript code. When other users view pages with the injected code, the scripts execute in their browsers, potentially compromising website integrity and stealing sensitive information from visitors.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Easy Google Fonts WordPress plugin. The plugin registers the control_selectors meta field with REST API access enabled but omits the required sanitize_callback parameter, allowing unsanitized data to be stored. On the frontend, this unsanitized data is output directly into <style> tags without proper HTML escaping. An authenticated attacker with Author-level privileges or above can inject arbitrary web scripts that persist in the database and execute whenever any user accesses the affected page. The vulnerability affects all versions up to and including 2.0.4; a patch is needed to add input sanitization and output escaping.
Affected products
- Easy Google Fonts Easy Google Fonts up to and including 2.0.4
Timeline
- 2026-09-10: disclosed