CVE-2012-20004: K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated remote attacker can craft a GET request containing a malicious ff parameter. A victim must load the crafted request for the injected script to execute in their browser.
Are default deployments affected?
The affected fontpicker endpoint is located under the plugin's web-accessible directory, so no authentication is required to reach it. Deployments using K-news versions before 1.1.1 are affected.
What can an attacker do if exploitation succeeds?
The injected script executes in the victim's browser in the site's context. The supplied information identifies session-cookie theft as a potential impact, and the vulnerability is also rated for low confidentiality and integrity impact.
What can be done if updating is not immediately possible?
Restrict access to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php at the web server or perimeter layer until the plugin can be updated. This reduces exposure to malicious requests targeting the ff parameter.