CVE-2026-95595 in Disable and Remove Google Fonts Plugin
Summary
by MITRE • 10/07/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS.
This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly: from n/a through 2.0.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified security flaw represents a classic instance of improper neutralization of input during web page generation, commonly categorized as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a reflected cross-site scripting attack within the Disable and Remove Google Fonts plugin for WordPress, affecting versions from n/a through 2.0.2. Reflected XSS occurs when malicious scripts are injected into legitimate websites via user input that is not properly sanitized before being returned to the browser in an HTTP response. In this context, the vulnerability likely stems from a failure to adequately validate or escape user-supplied data within one of the plugin's administrative interfaces or query parameters, allowing an attacker to inject executable JavaScript code that executes in the victim's browser session when they interact with a crafted link or form submission directed at the vulnerable endpoint.
From a technical perspective, this flaw aligns directly with CWE-79, which defines Improper Neutralization of Script-Related HTML Tags in Web Pages. The root cause typically involves server-side code that takes input from HTTP requests and embeds it into an HTML page without applying appropriate encoding or escaping mechanisms such as htmlspecialchars() or equivalent functions for the specific context where the data is rendered. Because this is a reflected XSS vulnerability, the malicious payload does not persist on the server but rather relies on social engineering to trick users into clicking a specially crafted URL that contains the exploit code in its parameters. When the vulnerable plugin processes these parameters and reflects them back in an HTML response without proper sanitization, the browser interprets the injected script as part of the page content, leading to execution within the security context of the website hosting the WordPress installation.
The operational impact of this vulnerability is significant for any organization relying on this plugin while failing to apply mitigations or updates promptly. An attacker can leverage reflected XSS to steal session cookies, which may lead to account takeover if administrative privileges are compromised. Additionally, the attacker could perform actions on behalf of the victim, such as changing settings, creating new administrator accounts, or exfiltrating sensitive data displayed within the WordPress dashboard. Since this plugin deals with GDPR and DSGVO compliance features, there is a heightened risk that attackers might manipulate privacy-related configurations or steal personal data processed by these tools. The attack vector requires user interaction, which limits automated exploitation but does not eliminate the threat, particularly in environments where administrators frequently interact with various URLs or share links internally.
This vulnerability maps to several entries within the MITRE ATT&CK framework for enterprise security. It falls under the Initial Access tactic via Spearphishing Link, as attackers often distribute malicious URLs through phishing campaigns. Once executed, it contributes to Credential Access by stealing session tokens and potentially enables Persistence if stored XSS vectors are discovered in related components. Furthermore, from a defense perspective, this issue underscores the importance of implementing Content Security Policy (CSP) headers which can mitigate the impact of reflected XSS even when input validation fails. Organizations should immediately update the Disable and Remove Google Fonts plugin to version 2.0.3 or later where the vulnerability is patched. In cases where updating is not immediately feasible, administrators should restrict access to administrative pages using strong authentication methods like multi-factor authentication and ensure that web application firewalls are configured to detect and block common XSS payloads in HTTP requests as a compensating control.