CVE-2012-20003 — Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsan…
Published: 2026-10-20 · CVSS: 5.1 · CVSS 4.0
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7