An improper neutralization of user input in the ACF: Google Font Selector plugin allows a reflected cross‑site scripting flaw. When an attacker places malicious script in a permitted field, the script is executed in the context of the website visitor, enabling actions such as session hijacking, defacement, or credential theft. The vulnerability is a classic reflected XSS (CWE‑79).

The flaw exists in the WordPress ACF: Google Font Selector plugin authored by Danielpataki. Versions from the initial release up to and including 3.0.1 are affected. Any WordPress site installing this plugin version is potentially vulnerable.

The CVSS score of 7.1 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely through crafted input or a malicious URL that an authenticated or unauthenticated user might follow; the vulnerability is reflected, so both users and visitors can be impacted.