Rocket Font

Rocket Font has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it remains unpatched as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Rocket Font has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2023.

Rocket Font is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Rocket Font vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2023-46067

Rocket Font <= 1.2.3 - Cross-Site Request Forgery via update_option_check_match_default

Read the full analysis

Vulnerability Records

1 records
Rocket Font – 한글 banner
Latestv2.1.2

Rocket Font – 한글

Rocketm2n

Author

Rocketm2n

4.6(5)
92/100
Last Updated
2026-10-26 (3d ago)
Active Installs
1,000+
Downloads
26,854
Requires WP
5.0+
Requires PHP
7.0+
Tested up to
WP 7.1.4
Created
2015-03-22 (12y ago)

한글 (Rocket Font) lets you use Korean (Hangul) web fonts on your WordPress site without touching any CSS. Pick a font, check the live preview, save – that’s all. 이런 분께 추천합니다 CSS 를 잘 다루지 못하는 분들을 위해 최대한 쉽게 만들었습니다. 설정 > 한글 폰트 메뉴를 엽니다. 마음에 드는 한글 폰트를 검색해서 고르고, 오른쪽 미리보기로 확인합니다. 변경 사항 저장을 누르면 사이트 전체에 적용됩니다. Features One-click Korean web fonts (Pretendard, SUIT, Nanum, Noto Sans KR, Google Fonts Korean families and more). Searchable font list (select2) and a live preview that stays in view while you scroll. Live preview while you change fonts, colors, sizes and line heights. Change the font of just the text you select while writing a post: a “한글” button in the block editor toolbar and in the classic editor toolbar (searchable font list). Only the fonts used in a post are loaded on the front end. Optional “Korean word wrap”: break lines at spaces instead of in the middle of a Korean word (CSS word-break: keep-all). Optional separate English font (choose from a list or enter a Google Fonts URL). Three one-click presets: whole site (body), per tag, or off. “Whole site” sizes headings automatically from the body size: p is the base, h6 is +2px, up to h1 at +12px, with proportional line heights. Or set body, h1-h6 and p separately: font on/off, text color, font size and line height. Apply the font only to specific classes / IDs (advanced). Alternative “force” application mode for themes that override fonts with !important. Use the same font in the classic editor (TinyMCE) – optional. Optional asynchronous font loading (experimental). Multisite ready: each site keeps its own settings and CSS file. Lightweight: your settings are written to a small minified CSS file. No front-end JavaScript unless you enable an option that needs it. 사용할 수 있는 폰트 모든 폰트는 웹 사용이 허용된 라이선스(대부분 SIL Open Font License)이고, 폰트 파일이 CDN(Google Fonts, jsDelivr) 에서 제공되는 것만 등록되어 있습니다. 폰트 파일은 내 서버에 저장되지 않습니다. 고딕 : 프리텐다드(Pretendard), SUIT, 원티드 산스, 노토 산스(Noto Sans KR), IBM Plex Sans KR, 나눔 고딕, 고운 돋움, 고딕 A1, 나눔 스퀘어, 나눔 바른 고딕 바탕 / 명조 : 노토 세리프(Noto Serif KR), 나눔 명조, 고운 바탕, 함렛, 송명 손글씨 : 나눔 펜글씨, 나눔 붓글씨, 개구, 하이멜로디, 감자꽃, 푸어 스토리, 동해 독도, 싱글 데이, 기랑 해랑, 흑백사진 제목 / 장식 : 검은고딕, 도현, 주아, 베이글 팻 원, 가석 원, 동글, 해바라기, 오르빗, 구기, 스타일리시, 귀여운 폰트, 연성, 독도, 배민 을지로체 코딩 : 나눔 고딕 코딩 폰트별 라이선스는 각 폰트 제공처의 안내를 따릅니다. External services This plugin loads web font stylesheets and font files from third-party CDNs. Fonts are loaded by the visitor’s browser, so the CDN receives the visitor’s IP address and browser information (User-Agent, Referer) when a page that uses the plugin is opened. The plugin itself does not send any other data to these services. Google Fonts (fonts.googleapis.com, fonts.gstatic.com) – used for the fonts that are hosted by Google. Privacy information: https://developers.google.com/fonts/faq/privacy / Terms: https://policies.google.com/terms jsDelivr (cdn.jsdelivr.net) – used for the fonts that are hosted on jsDelivr (Pretendard, SUIT, Wanted Sans, Nanum, etc.) and for the optional WebFont Loader script when asynchronous loading is enabled. Privacy policy: https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net / Terms: https://www.jsdelivr.com/terms cdnjs (cdnjs.cloudflare.com) – only if you enter a font CSS address from this host yourself. Privacy policy: https://www.cloudflare.com/privacypolicy/ If you enter your own font CSS address in the “영문 폰트 > 직접 입력하기” field, only https addresses on the hosts above are accepted. The settings screen loads the selected font stylesheets from the same services to show the preview. No JavaScript is loaded from external sites: the search box library (select2, MIT license) is bundled with the plugin.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C