CVE-2012-20004

Deferred Deferred - Pending Action

Reflected XSS in K-news WordPress Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2012-20004

Affected Vendors & Products

Vendor	Product	Version / Range
Carles Reverter	K-news	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in the K-news WordPress plugin before version 1.1.1. It allows unauthenticated attackers to inject malicious scripts by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to a specific plugin file with malicious 'ff' values that are echoed into option tags, enabling script execution and session cookie theft.

Detection Guidance

Check for the presence of the K-news WordPress plugin version before 1.1.1. Look for the vulnerable file path /wp-content/plugins/knews/wysiwyg/fontpicker/index.php. Test by sending a GET request with a malicious 'ff' parameter to see if unsanitized input is reflected in the response.

Impact Analysis

This vulnerability can allow attackers to steal session cookies, hijack user accounts, or perform actions on behalf of users. It may lead to unauthorized access to sensitive data, defacement of websites, or spreading malware to visitors. Users with admin privileges are particularly at risk.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling attackers to steal session cookies through reflected cross-site scripting. This may lead to unauthorized access to sensitive user data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update the K-news plugin to version 1.1.1 or later. If updating is not possible, consider disabling or removing the plugin immediately. Monitor network traffic for suspicious GET requests to the vulnerable path.

Hi! I’m here to help you understand CVE-2012-20004. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...