Remove Google Fonts WordPress plugin stored XSS via comment field
Visitors to WordPress sites can be hacked.
Summary
The Remove Google Fonts WordPress plugin stores malicious scripts submitted through the comment field, which run when a visitor opens the page. Unauthenticated attackers can exploit it, and all versions up to and including 1.7 are affected.
Affected when
- Remove mode of the plugin is active
- malicious comment is published (auto-approval or moderator approval)
What to do
Check that you run a version newer than 1.7, and update if not. No fixed version is named in the sources, so read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen