Kitch

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control selectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the control selectors meta field with show in rest enabled but without a sanitize callback, and subsequently outputting this unsanitized data directly into <style> tags on the frontend without proper escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Connect Contact Form 7 and Mailchimp versions prior to 0.9.78.07 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts through Mailchimp Merge Field Values. The execution is deferred and only triggers when an administrator performs a Contact Lookup for the email address submitted via the CF7 form. **Recommendations** Update the plugin to a version newer than 0.9.78.06.