The OMGF plugin for WordPress allows an unauthenticated attacker to inject arbitrary JavaScript through the 's' search parameter used in the comments‑atom feed. The malicious script is stored in a temporary file and then served unchanged, leading to a stored cross‑site scripting vulnerability that can execute when a user visits an affected page.

WordPress sites running the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin from daanvandenbergh, version 6.3.10 or older. Any installation of the host‑webfonts‑local plugin in these versions is affected.

The CVSS score of 7.2 indicates high severity. Successful exploitation requires the front‑end server to serve the retained .tmp file without a Content‑Type or X‑Content‑Type‑Options header, enabling browsers that perform MIME sniffing to execute the injected script. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated and only requires a properly configured web server; the risk is moderate to high with potential for widespread impact on all users who view the vulnerable pages.