CVE-2026-4657: Easy Google Fonts WordPress Plugin XSS Flaw

CVE-2026-4657 Overview

CVE-2026-4657 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Easy Google Fonts plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.4. The plugin registers the control_selectors meta field with show_in_rest enabled but omits a sanitize_callback. Unsanitized meta values are then written directly into <style> tags on the frontend without proper escaping. Authenticated users with Author-level access or higher can inject arbitrary JavaScript that executes when visitors view an affected page.

Critical Impact
Authenticated Author-level attackers can persist JavaScript payloads into published pages, enabling session theft, administrative account takeover, and drive-by redirection of site visitors.

Affected Products

Easy Google Fonts plugin for WordPress, versions through 2.0.4
WordPress sites that permit Author-level or higher registration
Any page rendered by the plugin's frontend style output routine

Discovery Timeline

2026-09-10 - CVE-2026-4657 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-4657

Vulnerability Analysis

The vulnerability resides in the plugin's post meta handling for the control_selectors field. WordPress requires a sanitize_callback argument when registering meta with register_post_meta or register_meta if show_in_rest is set to true. The Easy Google Fonts plugin registers control_selectors without this callback, so REST API writes to the field bypass server-side sanitization. The stored value is later concatenated into a <style> block emitted in the page <head>.

Because the output routine does not apply escaping suitable for a stylesheet context, an attacker can close the <style> element and inject a <script> block, or inject a CSS expression that triggers script execution in older browsers. See the plugin sources at src/includes/data.php, src/includes/settings.php, and src/includes/frontend.php for the vulnerable code paths.

Root Cause

The root cause is missing input sanitization and missing output escaping. Meta registration in src/includes/settings.php around line 123 exposes control_selectors to the REST API without a sanitize_callback. The frontend renderer in src/includes/frontend.php around line 185 outputs the stored value into a <style> context without escaping HTML control characters.

Attack Vector

An authenticated attacker with at least Author privileges sends a REST API request that updates the control_selectors post meta with a payload containing HTML-breaking content. When any user, including administrators, visits a page that references the injected meta, the browser parses the malicious markup and executes attacker-controlled script in the site origin. See the Wordfence Vulnerability Report for advisory details.

No verified public exploit code was released with this advisory. Refer to the linked plugin source lines for the affected code paths: data.php line 214, settings.php line 123, and frontend.php line 185.

Detection Methods for CVE-2026-4657

Indicators of Compromise

Post meta rows in wp_postmeta where meta_key = 'control_selectors' contain <, >, </style, or <script character sequences.
Web server access logs showing POST or PUT requests to /wp-json/wp/v2/posts/<id> or /wp-json/wp/v2/pages/<id> with control_selectors in the JSON body.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that use the plugin.

Detection Strategies

Query the WordPress database for control_selectors meta values containing angle brackets or script keywords and flag matching posts for review.
Inspect rendered HTML of pages using the plugin for <style> blocks whose contents break out of the style context.
Correlate REST API meta updates with the authoring account and compare against expected editorial activity.

Monitoring Recommendations

Enable audit logging for REST API meta writes and Author-role account activity.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages served by the plugin.
Alert on newly created Author accounts followed by REST API meta modifications within a short interval.

How to Mitigate CVE-2026-4657

Immediate Actions Required

Upgrade the Easy Google Fonts plugin to a version later than 2.0.4 once released by the maintainer.
Audit all Author-level and higher accounts and remove accounts that are no longer required.
Review existing control_selectors post meta values and remove any entries containing HTML or script content.

Patch Information

At the time of publication, the enriched CVE data does not list a fixed version. Monitor the Wordfence advisory and the plugin repository on WordPress.org for a release that adds a sanitize_callback to the control_selectors meta registration and applies context-appropriate escaping in the frontend renderer.

Workarounds

Deactivate the Easy Google Fonts plugin until a patched version is available.
Restrict Author-level and higher role assignments to trusted users only and disable open registration for privileged roles.
Deploy a Content Security Policy that blocks inline scripts and unauthorized external script sources to limit XSS impact.
Use a web application firewall rule to block REST API requests where the control_selectors field contains <, >, or script substrings.

bash

# Temporary mitigation: disable the plugin via WP-CLI
wp plugin deactivate easy-google-fonts

# Audit stored meta for suspicious content
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = 'control_selectors' \
  AND (meta_value LIKE '%<%' OR meta_value LIKE '%script%');"