The Google Font Fix plugin from Haozhe Xie contains an improper neutralization of input during page generation, allowing a reflected cross‑site scripting flaw. An attacker can supply malicious input that is echoed back into the browser without proper escaping, potentially leading to arbitrary script execution in the victim’s session. The weakness is a classic reflected XSS (CWE‑79) and can compromise confidentiality and integrity of user data if the attacker targets authenticated users or creates phishing payloads.

WordPress sites that use the Google Font Fix plugin version 2.3.1 or earlier are vulnerable. No further vendor or sub‑product details are provided, but the issue applies to all installations of the plugin in the affected version range.

The vulnerability scores a CVSS of 7.1, indicating high severity, but its EPSS score is below 1% and it is not listed in CISA’s KEV catalog, suggesting low current exploitation likelihood. The likely attack path is a reflected XSS, whereby an attacker crafts a specially crafted URL or input field that is reflected into the browser’s DOM. Because the flaw is client‑side, it requires user interaction but can lead to persistent malicious code execution if the victim visits the malicious link.