OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting
high
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possibl...
- CVSS:
- 8.6
- Affected:
- up to 5.7.9
- Fixed in:
- 5.7.10
- Disclosed:
- Jan 2, 2024
CVE-2023-6600 on NVD →
OMGF <= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal
medium
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
- CVSS:
- 4.9
- Affected:
- up to 4.5.11
- Fixed in:
- 4.5.12
- Disclosed:
- Dec 1, 2021
CVE-2021-25021 on NVD →
OMGF <= 4.5.3 - Unauthenticated Path Traversal in REST API
critical
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
- CVSS:
- 9.1
- Affected:
- up to 4.5.3
- Fixed in:
- 4.5.4
- Disclosed:
- Aug 23, 2021
CVE-2021-24638 on NVD →
OMGF <= 4.5.3 - Subscriber+ Arbitrary File/Folder Deletion
high
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
- CVSS:
- 8.1
- Affected:
- up to 4.5.3
- Fixed in:
- 4.5.4
- Disclosed:
- Aug 23, 2021
CVE-2021-24639 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database