Vulnerabilities and security researches forhost-webfonts-local host-webfonts-local

Oct 08, 2026

CVE, Research URL: CVE-2026-89417
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Date: Oct 07, 2026
Research Description: The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.
Affected versions: max 6.3.11.
Status: vulnerable

Oct 05, 2026

CVE, Research URL: CVE-2026-91828
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Date: Oct 02, 2026
Research Description: The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
Affected versions: max 6.3.11.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2023-6600
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Date: Jan 03, 2024
Research Description: The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.
Affected versions: max 5.7.10.
Status: vulnerable

CVE, Research URL: CVE-2021-25021
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Date: Jan 03, 2022
Research Description: The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Affected versions: max 4.5.12.
Status: vulnerable

CVE, Research URL: CVE-2021-24638
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Date: Sep 20, 2021
Research Description: The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Affected versions: max 4.5.4.
Status: vulnerable

CVE, Research URL: CVE-2021-24639
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Date: Sep 20, 2021
Research Description: The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
Affected versions: max 4.5.4.
Status: vulnerable