CVE-2026-4657

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control selectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the control selectors meta field with show in rest enabled but without a sanitize callback, and subsequently outputting this unsanitized data directly into tags on the frontend without proper escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.