CVE-2026-4657

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

CVE-2026-4657

Easy Google Fonts WordPress plugin (≤ 2.0.4) is vulnerable to an authenticated stored cross-site script via the control_selectors meta field. The plugin registers this field with show_in_rest enabled but omits a sanitize_callback, then outputs the unsanitized value directly into tags on the fron...

CVE-2026-4657 Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

CVE-2026-4657 Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

EUVD-2026-75240

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

CVE-2026-4657: Improper Neutralization of Input During Web Page Generation

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

WordPress Easy Google Fonts plugin <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kitch in WordPress Plugin Easy Google Fonts versions = 2.0.4...

PT-2026-89268

Name of the Vulnerable Software and Affected Versions Easy Google Fonts versions prior to 2.0.5 Description Stored Cross-Site Scripting occurs because the plugin registers the control selectors meta field with show in rest enabled but lacks a sanitize callback. Consequently, unsanitized data is...