OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
high
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...
- CVSS:
- 7.2
(Wordfence)
- Affected:
- up to 6.3.10
- Fixed in:
- 6.3.11
- Disclosed:
- Oct 6, 2026
CVE-2026-89417 on NVD →
OMGF <= 6.3.10 - Denial of Service to Unauthenticated Site Availability Exhaustion
high
The OMGF plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 6.3.10. This is due to missing capability check and nonce verification on the admin_init handler that triggers a slow server-side loopback request. This makes it possible for unauthenticated attackers to exhaust the s...
- CVSS:
- 7.5
(Wordfence)
- Affected:
- up to 6.3.10
- Fixed in:
- 6.3.11
- Disclosed:
- Sep 29, 2026
CVE-2026-91828 on NVD →
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting
high
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possibl...
- CVSS:
- 8.6
(Wordfence)
- Affected:
- up to 5.7.9
- Fixed in:
- 5.7.10
- Disclosed:
- Jan 2, 2024
CVE-2023-6600 on NVD →
OMGF <= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
medium
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
- CVSS:
- 4.9
(Wordfence)
- Affected:
- up to 4.5.11
- Fixed in:
- 4.5.12
- Disclosed:
- Dec 1, 2021
CVE-2021-25021 on NVD →
OMGF <= 4.5.3 - Unauthenticated Path Traversal in REST API
critical
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
- CVSS:
- 9.1
(Wordfence)
- Affected:
- up to 4.5.3
- Fixed in:
- 4.5.4
- Disclosed:
- Aug 23, 2021
CVE-2021-24638 on NVD →
OMGF <= 4.5.3 - Subscriber+ Arbitrary File/Folder Deletion
high
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
- CVSS:
- 8.1
(Wordfence)
- Affected:
- up to 4.5.3
- Fixed in:
- 4.5.4
- Disclosed:
- Aug 23, 2021
CVE-2021-24639 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database