Threats tagged 'ghsa-h5ch-qpr6-2h3j'

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the comment field in all versions up to and including 1.7. This vulnerability arises from insufficient input sanitization and output escaping in the plugin's Remove mode, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the malicious comment to be published, either automatically for known commenters or through manual approval by a moderator.