CVE-2026-97397

Name of the Vulnerable Software and Affected Versions Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance versions prior to 1.8

Description Stored Cross-Site Scripting occurs via the comment field due to a Regex-Mangled Output Buffer resulting from insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user accesses them. Exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.

Recommendations Update to a version newer than 1.7.