CVE-2012-20003: Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. They need to persuade a victim to open a crafted GET request to the plugin's iframe.php endpoint.
What conditions are required for exploitation?
The vulnerable Custom Tables plugin must be installed at a version earlier than 3.4.6. The crafted request uses s=1 and a malicious value in the key parameter.
What is the likely impact on a victim?
Injected JavaScript runs in the victim's browser in the affected site's context. The available data specifically identifies cookie theft as a possible outcome.
How can I check for attempted exploitation?
Review web server or application logs for requests to /wp-content/plugins/custom-tables/iframe.php that include s=1 and suspicious or script-like key parameter values.