The vulnerability is a stored cross‑site scripting flaw in the Remove Google Fonts plugin for WordPress that allows attackers to embed malicious scripts into comment content that is rendered unsanitized. In affected versions up to 1.7, a malicious script can be injected into any published comment. Once a user visits a page that displays the compromised comment, the injected code runs in that user's browser, potentially allowing attackers to steal credentials, deface content or execute further attacks. The weakness originates from inappropriate input sanitization and output escaping, classified as CWE‑79.

All versions of the plugin up to and including 1.7 are affected. The plugin, named Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance, is distributed by the easywpstuff feed and runs inside WordPress installations. Users of these WordPress sites that have installed this plugin are at risk.

The CVSS v3 score is 7.2, indicating a high severity cross‑site scripting vulnerability. No EPSS score is available, so the actual exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers need the plugin’s Remove mode to be active and comment publishing to be enabled, either through auto‑approval of known commenters or manual moderator approval. If those conditions are met, a non‑authenticated attacker can submit a comment containing a script, which will then be stored and later executed for any user who views the page that displays the comment.