Live › vulnerability › CVE-2012-20004
Go to dashboardThe K-news WordPress plugin before 1.1.1 echoes an unsanitized 'ff' parameter into a page, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser and steal session cookies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites with the K-news plugin installed at a version before 1.1.1 are exposed, because the vulnerable script is reachable by anyone over HTTP without logging in. Sites that do not have the knews plugin installed can skip this.
No product ranges from the sources yet.
wp plugin get knews --field=versionwp-content/plugins/knews/wysiwyg/fontpicker/index.php on the server1.1.1 or later/wp-content/plugins/knews/wysiwyg/fontpicker/index.phpEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2012-20004")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.