CVE-2026-4657: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in sunny_johal Easy Google Fonts

CVE-2026-4657 is a stored cross-site scripting vulnerability in the Easy Google Fonts WordPress plugin. The vulnerability arises from the control_selectors meta field being registered with show_in_rest enabled but without proper sanitization. Unsanitized input is rendered directly inside <style> tags on the frontend, enabling authenticated attackers with Author-level privileges or higher to inject malicious scripts. This can lead to script execution in the context of users visiting the injected pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the Author level.

An attacker with Author-level access or higher can inject arbitrary JavaScript into pages via the vulnerable meta field. This script executes in the context of users viewing those pages, potentially leading to session hijacking, defacement, or other malicious actions. There is no indication of impact on availability. The vulnerability affects confidentiality and integrity to a limited extent due to the required privileges and the nature of the injection point.

No official patch or remediation is currently confirmed. Users should monitor the vendor advisory for updates. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or replacing the Easy Google Fonts plugin if possible to reduce risk.