Custom Fonts – Host Your Fonts Locally Security & Risk Analysis

The "custom-fonts" plugin version 2.1.17 exhibits a generally strong security posture based on the static analysis. The absence of unprotected entry points (AJAX, REST API, shortcodes, cron events) is a significant positive. Furthermore, the code demonstrates excellent practices regarding SQL queries (100% prepared statements) and output escaping (100% properly escaped). Nonce and capability checks are implemented across a reasonable number of points, and there are no identified critical or high-severity taint flows.

However, the plugin's vulnerability history is a notable concern. With two known medium-severity CVEs, even though none are currently unpatched, it suggests a pattern of past security weaknesses. The common vulnerability types of Missing Authorization and Unrestricted Upload of File with Dangerous Type are particularly serious as they often lead to unauthorized access or malicious file execution. The most recent vulnerability being in 2026 is also an anomaly and might indicate a data entry error or a highly unusual release/patch cycle for the historical data, but it still highlights past issues. While the current version appears well-hardened in static analysis, the historical context necessitates caution, especially regarding file upload functionalities if they are exposed in any way, even if not immediately apparent in this static analysis snapshot.