CVE-2026-95595: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly

The vulnerability identified as CVE-2026-95595 is a reflected cross-site scripting (CWE-79) flaw in the 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' WordPress plugin. It arises from improper neutralization of input during web page generation, allowing an attacker to inject and execute arbitrary scripts via crafted input. This affects all versions of the plugin up to 2.0.2. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality, integrity, and availability of affected systems.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser. This may lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting use of the affected plugin to mitigate risk.