{"id":"CVE-2012-20004","kind":"vulnerability","aliases":["CVE-2012-20004"],"related":[],"title":"K-news WordPress plugin: reflected XSS steals session cookies via 'ff' parameter","description":"K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","summary":"The K-news WordPress plugin before 1.1.1 echoes an unsanitized 'ff' parameter into a page, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser and steal session cookies.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-1.1.1"],"how_to_check":"- Check the installed K-news plugin version in the WordPress admin under Plugins, or `wp plugin get knews --field=version`\n- Look for the file `wp-content/plugins/knews/wysiwyg/fontpicker/index.php` on the server","fix":"- Update the K-news plugin to `1.1.1` or later\n- If the plugin cannot be updated, remove it or block requests to `/wp-content/plugins/knews/wysiwyg/fontpicker/index.php`","status":"open","published_at":"2026-10-20T21:17:11+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:04:05+00:00","updated_at":"2026-10-25T04:04:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:04:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the K-news plugin to `1.1.1` or later\n- If the plugin cannot be updated, remove it or block requests to `/wp-content/plugins/knews/wysiwyg/fontpicker/index.php`","reach":"internet","title":"K-news WordPress plugin: reflected XSS steals session cookies via 'ff' parameter","impact":"medium","summary":"The K-news WordPress plugin before 1.1.1 echoes an unsanitized 'ff' parameter into a page, enabling reflected cross-site scripting. An attacker who gets a victim to open a crafted link can run script in the victim's browser and steal session cookies.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs script in visitors' browsers and steals session cookies","analyst_note":"Confirm the exposed versions and whether the Shadowserver 2023-10-19 observation involved active exploitation; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2012-20004 for the affected version range.","how_to_check":"- Check the installed K-news plugin version in the WordPress admin under Plugins, or `wp plugin get knews --field=version`\n- Look for the file `wp-content/plugins/knews/wysiwyg/fontpicker/index.php` on the server","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated-1.1.1"],"who_is_affected":"WordPress sites with the K-news plugin installed at a version before 1.1.1 are exposed, because the vulnerable script is reachable by anyone over HTTP without logging in. Sites that do not have the knews plugin installed can skip this.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3398,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':134C '-19':135C '-20004':16A,19A '-2012':15A,18A '/wp-content/plugins/knews/wysiwyg/fontpicker/index.php':107C '1.1.1':32B,77C '2023':133C 'allow':87C 'attack':48B,89C,101C 'browser':65B 'contain':78C 'cooki':10A,69B,122C 'craft':56B,103C 'cross':44B,82C 'cross-sit':43B,81C 'cve':14A,17A 'echo':33B,112C 'enabl':41B 'evid':124C 'execut':117C 'exploit':123C 'ff':12A,36B,99C,110C 'first':126C 'foundat':131C 'get':50B,104C 'host':23B 'inject':91C 'input':96C 'k':2A,27B,71C 'k-new':1A,26B,70C 'link':57B 'malici':109C 'news':3A,28B,72C 'observ':127C 'open':54B 'option':114C 'packag':20B 'page':40B 'paramet':13A,37B,100C 'plugin':5A,30B,73C 'reflect':6A,42B,80C 'request':105C 'run':59B 'script':46B,60B,84C,92C,118C 'self':22B 'self-host':21B 'session':9A,68B,121C 'shadowserv':130C 'site':45B,83C 'steal':8A,67B,120C 'suppli':94C 'tag':115C 'unauthent':88C 'unsanit':35B,95C 'valu':111C 'via':11A 'victim':52B,63B 'vulner':85C 'wordpress':4A,24B,29B,75C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the K-news plugin installed at a version before 1.1.1 are exposed, because the vulnerable script is reachable by anyone over HTTP without logging in. Sites that do not have the knews plugin installed can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T21:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2012-20004","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-20004","severity":null,"published_at":"2026-10-20T21:17:11+00:00","modified_at":"2026-10-23T03:16:29+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}