{"id":"CVE-2012-20003","kind":"vulnerability","aliases":["CVE-2012-20003"],"related":[],"title":"Custom Tables WordPress plugin: reflected script injection steals visitor cookies","description":"Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","summary":"The Custom Tables plugin for WordPress before 3.4.6 does not sanitize the 'key' parameter in iframe.php, so a crafted link runs script in the victim's browser. An attacker can use it to steal cookies, and no login is needed to send the link.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["custom-tables-plugin","package","self-hosted","wordpress"],"not_affected_if":["plugin-3.4.6-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Custom Tables plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/custom-tables/` style headers\n- Confirm whether `wp-content/plugins/custom-tables/iframe.php` exists on the site","fix":"- Update the Custom Tables plugin to `3.4.6` or later\n- If the plugin cannot be updated, remove it or block access to `iframe.php`","status":"open","published_at":"2026-10-20T21:17:11+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:04:05+00:00","updated_at":"2026-10-25T04:04:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:04:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Custom Tables plugin to `3.4.6` or later\n- If the plugin cannot be updated, remove it or block access to `iframe.php`","reach":"internet","title":"Custom Tables WordPress plugin: reflected script injection steals visitor cookies","impact":"medium","summary":"The Custom Tables plugin for WordPress before 3.4.6 does not sanitize the 'key' parameter in iframe.php, so a crafted link runs script in the victim's browser. An attacker can use it to steal cookies, and no login is needed to send the link.","category":"package","nicknames":[],"who_cares":["wordpress","custom-tables-plugin","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs script in visitor browsers and steals session cookies","analyst_note":"","how_to_check":"- Check the installed Custom Tables plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/custom-tables/` style headers\n- Confirm whether `wp-content/plugins/custom-tables/iframe.php` exists on the site","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-3.4.6-or-later"],"who_is_affected":"Sites running the Custom Tables WordPress plugin older than 3.4.6 are exposed, because iframe.php echoes the 'key' parameter without escaping. Sites without this plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3399,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':134C '-20':135C '-20003':13A,16A '-2012':12A,15A '/wp-content/plugins/custom-tables/iframe.php':105C '1':108C '2023':133C '3.4.6':33B,76C 'allow':86C 'attack':54B,88C,99C 'browser':52B,119C 'contain':77C 'cooki':10A,60B,122C 'craft':44B,101C 'cross':81C 'cross-sit':80C 'custom':1A,18B,27B,70C 'custom-tables-plugin':17B 'cve':11A,14A 'evid':124C 'execut':115C 'exploit':123C 'first':126C 'foundat':131C 'get':102C 'host':24B 'iframe.php':41B,98C 'inject':7A,90C 'key':38B,95C,112C 'link':45B,69B 'login':63B 'malici':111C 'need':65B 'observ':127C 'packag':21B 'paramet':39B,96C 'plugin':4A,20B,29B,72C 'reflect':5A,79C 'request':103C 'run':46B 'sanit':36B 'script':6A,47B,83C,91C,116C 'self':23B 'self-host':22B 'send':67B 'shadowserv':130C 'site':82C 'steal':8A,59B,121C 'tabl':2A,19B,28B,71C 'unauthent':87C 'unsanit':94C 'use':56B 'valu':113C 'victim':50B,118C 'visitor':9A 'vulner':84C 'wordpress':3A,25B,31B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Custom Tables WordPress plugin older than 3.4.6 are exposed, because iframe.php echoes the 'key' parameter without escaping. Sites without this plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2012-20003","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-20003","severity":null,"published_at":"2026-10-20T21:17:11+00:00","modified_at":"2026-10-23T16:16:48+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}