OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2024; all 4 are fixed as of September 2026. Their average CVSS score is 7.7, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 2 high. 2021 was the busiest year with 3 disclosures.

The most common weakness is Path Traversal, behind 2 of the records (50%). Other recurring categories include Improper Access Control, Missing Authorization.

Every one of the 4 issues recorded for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (2) reported by apple502j. OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
7.7/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.1CVE-2021-24638

OMGF <= 4.5.3 - Unauthenticated Path Traversal in REST API

Read the full analysis

Vulnerability Records

4 records
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. banner
Latestv6.3.10

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.

Daan van den Bergh

Author

Daan van den Bergh

4.7(212)
94/100
Last Updated
2026-08-11 (1mo ago)
Active Installs
300,000+
Downloads
10,944,833
Requires WP
5.9+
Requires PHP
7.3+
Tested up to
WP 7.0.4
Created
2018-06-27 (8y ago)

OMGF can be downloaded for free without any paid subscription from the official WordPress repository. Trusted by 300,000+ WordPress sites. The original Google Fonts self-hosting plugin. OMGF removes the connection between your site and Google’s font servers, eliminating the DNS lookups and render-blocking requests that slow down LCP and TTFB — while making your site GDPR/DSGVO-compliant in the process. German courts have ruled that loading Google Fonts directly violates GDPR, since visitor IPs get logged by Google. OMGF closes that gap entirely: nothing leaves your server. Install it and it works immediately. No setup required, though there’s plenty to fine-tune if you want to. Detection, Out of the Box OMGF scans your site for Google Fonts, Bunny Fonts (fonts.bunny.net), and Jetpack CDN (fonts-api.wp.com) and downloads them to your own server automatically. It even automatically detects and optimizes Google Fonts loaded by Elementor. Free Features Resource hints cleanup — Strips leftover preconnect, dns-prefetch, and preload hints pointing at fonts.googleapis.com and fonts.gstatic.com — dead weight once your fonts are self-hosted. font-display control — Force font-display: swap (or block, fallback, optional, auto) on your Google Fonts, fixing “Ensure text remains visible during webfont load” in Lighthouse and PageSpeed Insights. Performance Checker — Keeps an eye on your setup and flags what’s costing you points: unused subsets, unused weights, missing preloads above the fold, and layout shift from fonts loading late. Google Fonts checker — Pings you when a theme or plugin update introduces new Google Fonts that haven’t been processed yet. Manual control — Globally unload font families or weights you don’t need. Preload the ones that matter above the fold. Integrates with your stack — OMGF works alongside the optimization plugins and page builders you’re already running, including Autoptimize, FlyingPress, Kinsta, LiteSpeed Cache, SiteGround Speed Optimizer, W3 Total Cache, WP Fastest Cache, WP-Optimize, WP Rocket, WP Super Cache, Elementor, Divi, Beaver Builder, Bricks, Oxygen, and Visual Composer. OMGF Pro Where the free version covers the fundamentals, Pro removes the manual work entirely. Smart Optimize — Measures, on real visitor pageviews, exactly which fonts, subsets, and weights get used above the fold. Preloads what matters, strips what doesn’t. No configuration, no guessing — just measured results. Magic Fallbacks — Generates system font fallbacks mathematically tuned to match each Google Font’s real metrics (size-adjust, ascent-override), so text doesn’t jump around while fonts load. Zero CLS, calculated automatically per font. Deeper detection — Pro reaches fonts the free version and competitors don’t touch: – Inline <style> blocks with @font-face or @import – Local and externally hosted stylesheets using @import – Web Font Loader (webfont.js) – Async, JS-injected Google Fonts loaded at runtime – WordPress’s Font Manager (or Font Library, since WP 7.0) – Variable Fonts (fonts.googleapis.com/css2) – Material Icons Global font-display — Extends font-display control to every font on your site, not just Google Fonts. Everything else: – Automatic Multisite and WPML support – Serve fonts and stylesheets from your own CDN or custom path – Replace font families with system fonts entirely – Whitelabel stylesheets — strip OMGF branding and comments for smaller file sizes – Developer Mode for safely migrating between dev, staging, and production Get OMGF Pro → | Documentation | Tested Plugins & Themes

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C