CVE-2025-39382: ACF Google Font Selector XSS Vulnerability

CVE-2025-39382 Overview

CVE-2025-39382 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the ACF: Google Font Selector WordPress plugin developed by danielpataki. This vulnerability stems from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that execute in the context of a victim's browser session.

The vulnerability exists in all versions of the acf-google-font-selector-field plugin through version 3.0.1. When exploited, an attacker can craft malicious URLs containing JavaScript payloads that, when clicked by authenticated users, execute arbitrary code within their browser session on the affected WordPress site.

Critical Impact

Attackers can steal session cookies, redirect users to malicious sites, deface web pages, or perform actions on behalf of authenticated administrators, potentially leading to full site compromise.

Affected Products

• ACF: Google Font Selector plugin versions through 3.0.1
• WordPress sites using the acf-google-font-selector-field plugin
• Advanced Custom Fields implementations utilizing the Google Font Selector add-on

Discovery Timeline

• April 24, 2025 - CVE-2025-39382 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2025-39382

Vulnerability Analysis

This Reflected XSS vulnerability occurs when user-supplied input is echoed back to the browser without proper sanitization or encoding. The ACF: Google Font Selector plugin fails to adequately neutralize special characters in user input before incorporating that input into the rendered HTML output.

Reflected XSS attacks require social engineering to succeed, as the victim must click a malicious link or visit a compromised page. However, when successful against WordPress administrators, the consequences can be severe, including unauthorized plugin installation, user creation, or site configuration changes.

The cross-site nature of this vulnerability (indicated by the changed scope in the attack characteristics) means that successful exploitation can affect resources beyond the vulnerable component itself, potentially impacting the entire WordPress installation and its users.

Root Cause

The root cause of CVE-2025-39382 is the absence of proper input validation and output encoding within the ACF: Google Font Selector plugin. When processing font selection parameters or related input fields, the plugin directly incorporates untrusted data into HTML output without escaping HTML entities or JavaScript special characters.

WordPress provides several sanitization functions such as esc_html(), esc_attr(), and wp_kses() specifically designed to prevent XSS attacks. The vulnerable code path in this plugin fails to apply these protective measures, creating the opportunity for script injection.

Attack Vector

The attack vector for this vulnerability is network-based, requiring user interaction to succeed. An attacker would typically craft a malicious URL containing JavaScript payload encoded within request parameters handled by the vulnerable plugin.

The exploitation typically follows this sequence: the attacker identifies a vulnerable endpoint in the ACF: Google Font Selector plugin that reflects user input, constructs a URL with an embedded XSS payload targeting that endpoint, and then distributes the malicious link to potential victims through phishing emails, social media, or compromised websites. When a victim clicks the link while authenticated to the WordPress site, the malicious script executes with their privileges.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-39382

Indicators of Compromise

• Suspicious URLs in web server access logs containing encoded JavaScript payloads targeting plugin endpoints
• Unexpected administrative actions or configuration changes following user interaction with external links
• Browser-based alerts or anomalous behavior reported by site users after clicking links
• Presence of unauthorized admin accounts or modified user privileges

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payload patterns in request parameters
• Monitor WordPress access logs for requests containing common XSS indicators such as <script>, javascript:, or event handlers like onerror
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Utilize WordPress security plugins that scan for known vulnerable plugin versions

Monitoring Recommendations

• Enable comprehensive logging on the WordPress installation to capture all HTTP requests and responses
• Configure real-time alerting for suspicious request patterns targeting ACF-related endpoints
• Implement browser-side monitoring through CSP violation reporting to detect exploitation attempts
• Regularly audit installed plugin versions against vulnerability databases

How to Mitigate CVE-2025-39382

Immediate Actions Required

• Update the ACF: Google Font Selector plugin to the latest patched version immediately
• If no patch is available, consider disabling or removing the acf-google-font-selector-field plugin until a fix is released
• Implement Web Application Firewall rules to filter XSS payloads targeting the vulnerable plugin
• Review WordPress user accounts and audit recent administrative actions for signs of compromise
• Educate users about the risks of clicking suspicious links, especially when logged into WordPress

Patch Information

At the time of publication, site administrators should check the Patchstack Vulnerability Report for the latest patch availability and remediation guidance. Upgrade from version 3.0.1 or earlier to any version that addresses this XSS vulnerability.

Workarounds

• Temporarily deactivate the ACF: Google Font Selector plugin if the font selection functionality is not critical to site operations
• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Use a WAF service to filter malicious requests before they reach the WordPress application
• Restrict plugin access to trusted administrator IP addresses if possible

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com;"