CVE-2026-4657 : Detail

CVE-2026-4657

6.4
/
Sedang
2026-09-10
04h18 +00:00
Cross-site Scripting
A03-Injection
Network
2026-09-10
18h18 +00:00
CVE.org
NVD
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control_selectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the control_selectors meta field with show_in_rest enabled but without a sanitize_callback, and subsequently outputting this unsanitized data directly into