CVE-2012-20003 Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
MediumCVSS 5.1
EPSS 0.27%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Web Updates KMU Custom Tables | < 3.4.6 | 3.4.6 |
| wordpress custom-tables(WordPress) | <= 3.4.4 | No fix listed |
References
- EDB-37482 exploit
- WPScan Advisory third-party-advisory
- Acunetix Advisory third-party-advisory
- Nuclei Template technical-description
- WordPress Download Page product
- VulnCheck Advisory: Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org