Stored Cross-Site Scripting Vulnerability in Remove Google Fonts Plugin for WordPress
CVE-2026-97397

7.2HIGH

Key Information:

Vendor

WordPress
Status
Remove Google Fonts – Disable, Block, Or Replace With Bunny Fonts For Gdpr Compliance
Vendor
CVE Published:
4 November 2026

What is CVE-2026-97397?

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the Comment Field. This issue arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary scripts into pages. When the plugin's Remove mode is active and a malicious comment successfully publishes (either automatically for known commenters or through manual moderation), the injected script executes whenever a user accesses the affected page. This type of vulnerability can significantly impact site security and user safety.

Affected Version(s)

Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance 0 <= 1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/use-bunnyfont-...
https://plugins.trac.wordpress.org/browser/use-bunnyfont-...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17y
.