The Fonts Manager | Custom Fonts plugin supplied by Wisdomlogix Solutions Pvt. Ltd. fails to escape user‑supplied input before it is rendered as part of a web page. This allows a reflected XSS payload to be injected into the page when a victim accesses crafted input, enabling arbitrary client‑side code execution. Depending on the victim’s permissions, an attacker could hijack session cookies, deface the site, or redirect users to malicious domains.

Any WordPress deployment that has installed the Fonts Manager | Custom Fonts plugin with a version equal to or earlier than 1.2 is affected. The single vendor is Wisdomlogix Solutions Pvt. Ltd.; no fix has been released for versions prior to 1.3, so administrators should verify whether the plugin has been upgraded beyond the vulnerable release. If the plugin is not used, the risk is eliminated.

A CVSS score of 7.1 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely by sending a malicious link or input to a user; no authentication is required. The combination of high impact and low likelihood means that fixing the plugin promptly is strongly recommended to avoid potential client‑side compromise.