Embed Google Fonts
Embed Google Fonts has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Embed Google Fonts has a vendor fix available, so running the current release closes it.
All of these findings were reported by Abdi Pranata. Embed Google Fonts is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.
CVE-2024-33925Embed Google Fonts <= 3.1.0 - Missing Authorization
Read the full analysisVulnerability Records
Embed Google Fonts
Author
Adrian Mörchen
Embed Google Fonts tries to automatically replace registered Google Fonts from themes and plugins with local versions, directly loaded from your own server. Contribute: https://github.com/moewe-io/embed-google-fonts Notes The first request might be very slow, as fonts are downloaded and cached the first time they are requested. This doesn’t automatically replace all your Google fonts with local versions. If a plugin/theme doesn’t use WordPress wp_enqueue_style it probably won’t work. Loaded fonts are not optimized, means, the whole font including all subsets is loaded See FAQ for instructions to use locally hosted fonts directly and avoid using Heroku Thank you: Fonts are downloaded using: https://gwfh.mranftl.com/fonts
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C