{"id":"CVE-2026-97397","kind":"vulnerability","aliases":["CVE-2026-97397"],"related":[],"title":"Remove Google Fonts WordPress plugin (<= 1.7): unauthenticated stored XSS via comments; no patch, plugin closed","description":"The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.","summary":"The Remove Google Fonts plugin for WordPress, in all versions up to and including 1.7, fails to sanitize comment content in its output buffer handling. An unauthenticated attacker can post a comment carrying script that runs in the browser of any visitor who opens the affected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"use-bunnyfont-host-google-fonts","fixed":[],"affected":"<= 1.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["comments","no-fix","package","php","wordpress"],"not_affected_if":["comments-disabled","comments-moderated","plugin-not-installed","remove-mode-off"],"how_to_check":"- In WordPress admin under Plugins, look for 'Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance' (slug use-bunnyfont-host-google-fonts). Any version up to and including 1.7 is affected (1.7 is the latest).\n- Check whether its Remove mode is enabled in the plugin settings.\n- Check whether comments are published automatically (known commenters) or only after moderator approval. Review already-published comments for script tags.","fix":"No patched version exists. Wordfence lists it as unpatched, and WordPress.org closed the plugin on Oct 28, 2026 (described as temporary, pending review). Deactivate and delete the plugin, or switch to another Google Fonts removal plugin.","status":"open","published_at":"2026-11-04T12:17:07+00:00","first_seen_at":"2026-11-04T12:26:52+00:00","triaged_at":"2026-11-04T12:27:39+00:00","updated_at":"2026-11-04T12:28:47+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-04T12:27:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Google Fonts plugin: comment field enables stored cross-site scripting","impact":"medium","summary":"The Remove Google Fonts plugin for WordPress, in all versions up to and including 1.7, fails to sanitize comment content in its output buffer handling. An unauthenticated attacker can post a comment carrying script that runs in the browser of any visitor who opens the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","comments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on affected pages","analyst_note":"Confirm the patched plugin version and whether a fix is released; the NVD entry as provided does not state one.","how_to_check":"- Check whether the plugin is installed and active in WordPress admin under Plugins, and note its version.\n- Check whether its Remove mode is enabled in the plugin settings.\n- Check whether comments are published automatically or after moderator approval.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","remove-mode-off","comments-moderated"],"who_is_affected":"Sites running the plugin at version 1.7 or earlier with its Remove mode active. Exploitation also needs a malicious comment to be published, either through auto-approval for known commenters or by a moderator. Sites without the plugin, or with Remove mode off, are not exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4260,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched plugin version and whether a fix is released; the NVD entry as provided does not state one.","search":"'-2026':17A,20A '-97397':18A,21A '1.7':6A,49B,123C 'access':152C 'activ':166C 'affect':80B 'approv':178C,185C 'arbitrari':141C 'attack':62B,138C 'auto':177C 'auto-approv':176C 'block':87C 'browser':73B 'buffer':58B,115C 'bunni':91C 'bunnyfont':24A 'carri':67B 'close':15A 'comment':11A,28B,53B,66B,108C,170C,181C 'complianc':95C 'content':54B 'cross':104C 'cross-sit':103C 'cve':16A,19A 'disabl':86C 'due':124C 'either':174C 'escap':131C 'execut':148C 'exploit':157C 'fail':50B 'field':109C 'fix':31B 'font':3A,38B,85C,92C 'fonts':27A 'gdpr':94C 'googl':2A,37B,84C 'google':26A 'handl':59B 'host':25A 'includ':48B,122C 'inject':140C,154C 'input':127C 'insuffici':126C 'known':180C 'make':133C 'malici':169C 'mangl':113C 'manual':183C 'mode':163C 'moder':184C 'no-fix':29B 'open':78B 'output':57B,114C,130C 'packag':32B 'page':81B,145C,155C 'patch':13A 'php':33B 'plugin':5A,14A,39B,96C,160C 'possibl':135C 'post':64B 'publish':173C 'regex':112C 'regex-mangl':111C 'remov':1A,36B,83C,162C 'replac':89C 'requir':158C 'run':70B 'sanit':52B,128C 'script':68B,106C,143C 'site':105C 'store':8A,102C 'success':156C 'unauthent':7A,61B,137C 'use':23A 'use-bunnyfont-host-google-fonts':22A 'user':151C 'version':44B,118C 'via':10A,107C,110C 'visitor':76B 'vulner':100C 'web':142C 'whenev':149C 'wordpress':4A,34B,41B,98C 'xss':9A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Remove Google Fonts plugin (use-bunnyfont-host-google-fonts) at version 1.7 or earlier with Remove mode on. An unauthenticated visitor can post a comment that runs script in visitors' browsers once it is published, either by auto-approval for known commenters or by a moderator. Sites without the plugin, with Remove mode off, or with comments disabled are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["usebunnyfonthostgooglefonts"],"ptokens":["bunnyfont","fonts","google","host","use"],"labels":["comments","high","nofix","package","php","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97397","severity":null,"published_at":"2026-11-04T12:17:07+00:00","modified_at":"2026-11-04T12:17:07+00:00","first_seen_at":"2026-11-04T12:26:52+00:00","fetched_at":"2026-11-04T12:26:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97397:1666","url":null,"severity":null,"published_at":"2026-11-04T12:28:47+00:00","modified_at":"2026-11-04T12:28:47+00:00","first_seen_at":"2026-11-04T12:28:47+00:00","fetched_at":"2026-11-04T12:28:47+00:00","note":"Wordfence advisory (CNA, researcher theviper17y) lists Unpatched, all versions <=1.7; wordpress.org page shows plugin closed Oct 28 2026 pending review. No vendor advisory or fixed version found. No exploitation or PoC seen. Not marking verified: no vendor statement on fix or mitigation."}],"documents":[{"id":66855,"url":"https://wordpress.org/plugins/use-bunnyfont-host-google-fonts/","title":"Remove Google Fonts plugin page (closed Oct 28, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"This plugin has been closed as of October 28, 2026 and is not available for download. This closure is temporary, pending a full review.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":66856,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/use-bunnyfont-host-google-fonts/remove-google-fonts-17-unauthenticated-stored-cross-site-scripting-via-comment-field-via-regex-mangled-output-buffer","title":"Wordfence: Remove Google Fonts <= 1.7 Unauthenticated Stored XSS via Comment Field","kind":"advisory","source":"analyst","publisher":null,"text":"CVE-2026-97397, CVSS 7.2, researcher theviper17y, published Nov 3 2026. All versions up to and including 1.7. Requires Remove mode active and malicious comment published (auto-approval for known commenters or moderator approval). Status: Unpatched. Plugin slug use-bunnyfont-host-google-fonts, status Removed, ~800 active installs.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}