CyberzSOC

On January 2, 2024, an unauthenticated Stored Cross-Site Scripting (XSS) and directory deletion vulnerability has been discovered in the “OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. This vulnerability, identified as CVE-2023-6600 (CVSS score of 8.6)[1], may allow unauthenticated attackers to update the plugin’s settings and inject malicious scripts into affected sites [2]. This vulnerability could affect sites that have the OMGF plugin installed and configured, which is estimated to be over 300,000 sites [3]. The OMGF plugin vulnerability occurs due to a missing capability check on the update_settings() function hooked via admin_init . This allows unauthenticated attackers to modify the plugin’s settings, leading to Stored Cross-Site Scripting and directory deletion. “OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.” plugin version 5.7.9 and below. 5.7.10 as it contains the necessary fixes.