---
id: "CVE-2026-97397"
kind: "vulnerability"
aliases: ["CVE-2026-97397"]
title: "Remove Google Fonts WordPress plugin (<= 1.7): unauthenticated stored XSS via comments; no patch, plugin closed"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "use-bunnyfont-host-google-fonts", "fixed": [], "affected": "<= 1.7", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["comments", "no-fix", "package", "php", "wordpress"]
not_affected_if: ["comments-disabled", "comments-moderated", "plugin-not-installed", "remove-mode-off"]
published_at: "2026-11-04T12:17:07+00:00"
first_seen_at: "2026-11-04T12:26:52+00:00"
updated_at: "2026-11-04T12:28:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97397", "first_seen_at": "2026-11-04T12:26:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T12:28:47+00:00"}]
---

# Remove Google Fonts WordPress plugin (<= 1.7): unauthenticated stored XSS via comments; no patch, plugin closed

The Remove Google Fonts plugin for WordPress, in all versions up to and including 1.7, fails to sanitize comment content in its output buffer handling. An unauthenticated attacker can post a comment carrying script that runs in the browser of any visitor who opens the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:use-bunnyfont-host-google-fonts affected <= 1.7 fixed ?

## How to check

- In WordPress admin under Plugins, look for 'Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance' (slug use-bunnyfont-host-google-fonts). Any version up to and including 1.7 is affected (1.7 is the latest).
- Check whether its Remove mode is enabled in the plugin settings.
- Check whether comments are published automatically (known commenters) or only after moderator approval. Review already-published comments for script tags.

## Fix

No patched version exists. Wordfence lists it as unpatched, and WordPress.org closed the plugin on Oct 28, 2026 (described as temporary, pending review). Deactivate and delete the plugin, or switch to another Google Fonts removal plugin.

## Timeline

- 2026-11-04T12:26:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97397
- 2026-11-04T12:28:47+00:00 analyst — Wordfence advisory (CNA, researcher theviper17y) lists Unpatched, all versions <=1.7; wordpress.org page shows plugin closed Oct 28 2026 pending review. No vendor advisory or fixed version found. No exploitation or PoC seen. Not marking verified: no vendor statement on fix or mitigation.

## Documents

- [advisory] Remove Google Fonts plugin page (closed Oct 28, 2026) https://wordpress.org/plugins/use-bunnyfont-host-google-fonts/
- [describes] Wordfence: Remove Google Fonts <= 1.7 Unauthenticated Stored XSS via Comment Field https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/use-bunnyfont-host-google-fonts/remove-google-fonts-17-unauthenticated-stored-cross-site-scripting-via-comment-field-via-regex-mangled-output-buffer

## From the sources

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_