CVE-2026-91828

Published 2 October 2026 · tracked since 2 October 2026

Description

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-104606 MEDIUM 6.3
• CVE-2026-94541 CRITICAL 9.8
• CVE-2026-87920 HIGH 7.2
• CVE-2026-103552 HIGH 7.3
• CVE-2026-97663 HIGH 7.2
• CVE-2026-97338 MEDIUM 6.4
• CVE-2026-97342 HIGH 7.2
• CVE-2026-97634 MEDIUM 6.5
• CVE-2026-97637 CRITICAL 9.8
• CVE-2026-97641 HIGH 7.2

→ Open the live CVE board · all tools