CVE-2026-4657: Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, and subsequently outputting this unsanitized data directly into <style> tags on the frontend without proper escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Author-level access or higher can exploit it. The attacker must be able to set the control_selectors meta field.
When does the injected script execute?
The payload is stored and emitted in frontend <style> tags. It executes when a user visits a page containing the attacker-injected content.
What versions are affected?
All Easy Google Fonts versions through 2.0.4, including 2.0.4, are affected.