CVE-2012-20003
Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
| CWE | CWE-79 |
| Vendor | web updates kmu |
| Product | custom tables |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for web updates kmu custom tables
Be the first to know when new medium vulnerabilities affecting web updates kmu custom tables are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Web Updates KMU / Custom Tables
0 < 3.4.6
References
exploit-db.com: https://www.exploit-db.com/exploits/37482 wpscan.com: https://wpscan.com/vulnerability/211a4286-4747-4b62-acc3-fd9a57b06252 acunetix.com: https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-custom-tables-key-parameter-cross-site-scripting-3-4-4/ github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-custom-tables-xss.yaml wordpress.org: https://wordpress.org/plugins/custom-tables/ vulncheck.com: https://www.vulncheck.com/advisories/custom-tables-wordpress-plugin-3.4.6-reflected-xss-via-iframe-php
Credits
Sammy FORGIT 🔍 The Shadowserver Foundation