CVE-2025-39382

The ACF: Google Font Selector plugin for WordPress suffers from a reflected cross-site scripting (XSS) vulnerability due to insufficient input sanitization [1]. Attackers can exploit this by crafting a malicious link that, when clicked by a user with certain privileges, reflects the payload back to the user, executing in the context of the vulnerable site. This requires user interaction, such as clicking a link or visiting a crafted page [1]. Successful exploitation allows attackers to inject arbitrary HTML and JavaScript, potentially leading to redirects, advertisements, or other malicious actions on the affected site [1]. To mitigate, users are advised to update the plugin immediately or apply a virtual patch if an update is not yet available [1].