CVE-2012-20003

Received Received - Intake

Reflected XSS in Custom Tables WordPress Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2012-20003

Affected Vendors & Products

Vendor	Product	Version / Range
Web Updates KMU	Custom Tables	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in the Custom Tables plugin for WordPress versions before 3.4.6. It allows unauthenticated attackers to inject malicious scripts via the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to execute scripts in victims' browsers and steal cookies.

Detection Guidance

Check for the presence of the Custom Tables plugin in WordPress installations. Look for requests to /wp-content/plugins/custom-tables/iframe.php with parameters s=1 and an unsanitized 'key' value. Monitor web server logs for suspicious iframe.php access patterns.

Impact Analysis

An attacker could exploit this to run malicious scripts in your browser when visiting a vulnerable site, potentially stealing session cookies, login credentials, or other sensitive data. It may also enable further attacks like phishing or malware delivery.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling attackers to inject malicious scripts through reflected cross-site scripting. This may lead to unauthorized access to sensitive user data, including cookies or session tokens, which could violate data protection requirements under these regulations.

Mitigation Strategies

Update the Custom Tables plugin to version 3.4.6 or later. If updating is not possible, consider disabling or removing the plugin immediately. Implement web application firewall rules to block requests to iframe.php with unsanitized parameters.

Hi! I’m here to help you understand CVE-2012-20003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...