The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance WordPress plugin up to version 1.7 is vulnerable to stored cross-site scripting (XSS) via the comment field. This vulnerability arises from insufficient input sanitization and output escaping in the plugin's Remove mode, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the malicious comment to be published either automatically for known commenters or through manual approval by a moderator.