CVE-2025-30614: Google Font Fix Plugin XSS Vulnerability

CVE-2025-30614 Overview

CVE-2025-30614 is a reflected cross-site scripting (XSS) vulnerability in the Haozhe Xie Google Font Fix WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All versions through 2.3.1 are affected. An attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session under the trust context of the WordPress site.

Critical Impact

Successful exploitation allows attackers to execute arbitrary scripts in a victim's browser, enabling session theft, credential harvesting, or redirection to attacker-controlled infrastructure. The scope is changed, meaning impact extends beyond the vulnerable component.

Affected Products

• Haozhe Xie Google Font Fix plugin for WordPress
• All versions from initial release through 2.3.1
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2025-04-01 - CVE CVE-2025-30614 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30614

Vulnerability Analysis

The Google Font Fix plugin fails to properly sanitize and encode user-controlled input before reflecting it back into HTML responses. This results in a reflected XSS condition where attacker-supplied payloads embedded in request parameters render as executable script in the response page.

Reflected XSS requires user interaction. A victim must click or otherwise load a crafted URL. The attack vector is network-based and requires no authentication, which broadens the pool of potential victims to any logged-in administrator, editor, or site visitor who can be lured to the malicious link.

Because the scope is changed, JavaScript executed through this flaw can interact with resources beyond the vulnerable plugin context, including session cookies and DOM elements of the broader WordPress site.

Root Cause

The root cause is missing or insufficient output encoding on request parameters processed by the plugin. WordPress provides escaping helpers such as esc_html(), esc_attr(), and wp_kses(), but the affected plugin code paths reflect input back into the response without applying them consistently.

Attack Vector

An attacker constructs a URL targeting a vulnerable plugin endpoint with a JavaScript payload inside a reflected parameter. The attacker then delivers the link through phishing email, social media, or a malicious site. When the victim loads the link, the browser parses and executes the injected script within the origin of the WordPress site.

The vulnerability mechanism is documented in the Patchstack Vulnerability Report. No public proof-of-concept code has been released at this time.

Detection Methods for CVE-2025-30614

Indicators of Compromise

• HTTP requests to plugin endpoints containing <script>, javascript:, onerror=, or onload= patterns in query parameters
• Web server access logs showing unusually long or URL-encoded parameter values targeting Google Font Fix plugin paths
• Referer headers pointing to suspicious external domains preceding requests to the WordPress site
• Unexpected outbound browser traffic from administrator sessions to attacker-controlled hosts

Detection Strategies

• Deploy a Web Application Firewall (WAF) with rules to identify reflected XSS payloads in request parameters
• Monitor WordPress access logs for query strings containing HTML or JavaScript syntax targeting the plugin
• Implement Content Security Policy (CSP) reporting to capture inline script execution attempts
• Correlate authentication events with subsequent administrative actions to identify session abuse

Monitoring Recommendations

• Alert on any HTTP request to plugin endpoints containing reserved characters like <, >, ", or ' in parameters
• Track plugin version inventory across WordPress installations to identify hosts running 2.3.1 or earlier
• Monitor for new administrator accounts, plugin installations, or theme modifications following suspicious request patterns
• Review browser console logs and CSP violation reports for blocked script executions

How to Mitigate CVE-2025-30614

Immediate Actions Required

• Identify all WordPress installations running the Google Font Fix plugin and inventory affected versions
• Deactivate and remove the plugin if a patched version is not yet available or required
• Apply WAF rules to block requests containing XSS payloads targeting plugin endpoints
• Force password resets and invalidate active sessions for privileged WordPress accounts as a precaution

Patch Information

At the time of publication, the vulnerability affects all versions through 2.3.1. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for any subsequent vendor-released patches. If no fix is available, removal is the recommended action.

Workarounds

• Remove the Google Font Fix plugin until a patched release is published
• Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
• Restrict WordPress administrative access by IP allowlisting and require multi-factor authentication
• Train administrators and editors to avoid clicking unsolicited links pointing to their own WordPress site

# Configuration example - example CSP header to mitigate reflected XSS
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"