The GMO Font Agent plugin suffers from an improper neutralization of user input during web page generation, leading to a stored cross‑site scripting vulnerability. An attacker could inject malicious script that persists on the website and is executed in the browsers of visitors. Based on typical XSS impacts, this could allow arbitrary client‑side code execution, potentially enabling credential theft, session hijack, or site defacement.

All installations of the GMO Font Agent plugin version 1.6 or earlier, distributed by Z.com byGMO, are affected. The vulnerability is present regardless of the WordPress site configuration.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not included in the CISA KEV catalog. The attack vector is likely through any input or administrative interface of the plugin where malicious payloads can be stored; this inference is drawn because the description specifies a stored XSS but does not reveal the exact entry point.