Live › vulnerability › CVE-2012-20003
Go to dashboardThe Custom Tables plugin for WordPress before 3.4.6 does not sanitize the 'key' parameter in iframe.php, so a crafted link runs script in the victim's browser. An attacker can use it to steal cookies, and no login is needed to send the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Custom Tables WordPress plugin older than 3.4.6 are exposed, because iframe.php echoes the 'key' parameter without escaping. Sites without this plugin installed can skip it.
No product ranges from the sources yet.
wp-content/plugins/custom-tables/ style headerswp-content/plugins/custom-tables/iframe.php exists on the site3.4.6 or lateriframe.phpEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
This page as .md · .json · in your agent: get_signal("CVE-2012-20003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.