CVE-2023-6600

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.

• CWE-862
• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3008876%40host-webfonts-local&new=3008876%40host-webfonts-local&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009010%40host-webfonts-local&new=3009010%40host-webfonts-local&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009453%40host-webfonts-local&new=3009453%40host-webfonts-local&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4e835b97-c066-4e8f-b99f-1a930105af0c?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3008876%40host-webfonts-local&new=3008876%40host-webfonts-local&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009010%40host-webfonts-local&new=3009010%40host-webfonts-local&sfp_email=&sfph_mail=Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009453%40host-webfonts-local&new=3009453%40host-webfonts-local&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4e835b97-c066-4e8f-b99f-1a930105af0c?source=cveThird Party Advisory

Published

Jan 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6594The WordPress Button Plugin MaxButtons plugin for WordPress …4.8
• CVE-2023-6595In WhatsUp Gold versions released before 2023.1, an API endp…5.3
• CVE-2023-6596An incomplete fix was shipped for the Rapid Reset (CVE-2023-…7.5
• CVE-2023-6597An issue was found in the CPython `tempfile.TemporaryDirecto…7.8
• CVE-2023-6598The SpeedyCache plugin for WordPress is vulnerable to unauth…4.3
• CVE-2023-6599Missing Standardized Error Handling Mechanism in GitHub repo…4.3
• CVE-2023-6601A flaw was found in FFmpeg's HLS demuxer. This vulnerability…4.7
• CVE-2023-6602A flaw was found in FFmpeg's TTY Demuxer. This vulnerability…5.3
• CVE-2023-6603A flaw was found in FFmpeg's HLS playlist parsing. This vuln…7.5
• CVE-2023-6604A flaw was found in FFmpeg. This vulnerability allows unexpe…5.3
• CVE-2023-6605A flaw was found in FFmpeg's DASH playlist support. This vul…7.2
• CVE-2023-6606An out-of-bounds read vulnerability was found in smbCalcSize…7.1