CVE-2026-89417: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in daanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.

CVE-2026-89417 describes a stored cross-site scripting vulnerability in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin. The vulnerability exists in all versions up to and including 6.3.10 and is triggered via the 's' search parameter in the comments-atom feed. Due to inadequate input sanitization and output escaping, an attacker can inject arbitrary web scripts that execute in the context of users visiting the injected pages. The exploitation depends on the front-end server serving a retained .tmp file without a Content-Type or X-Content-Type-Options header, which allows MIME-sniffing browsers such as Chromium to execute the injected script. This condition is common in default configurations of Apache and nginx/php-fpm servers.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users accessing the affected pages, potentially leading to information disclosure and limited integrity impacts. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider configuring their web servers to serve .tmp files with appropriate Content-Type headers and enable X-Content-Type-Options to prevent MIME sniffing. Additionally, monitoring for unusual activity related to the comments-atom feed and restricting access to this feed may reduce exposure.