CVE-2012-20003
Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Web Updates KMU Custom Tables
CVSS
5.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 23 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.4.6Custom TablesCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Text from CVE List
Affected versions 1
- Custom Tablesaffected: all versions before 3.4.6CVE List
References 6
- wpscan.com/vulnerability/211a4286-4747-4b62-acc3-fd9a57b06252Advisoryvia CVE List
- acunetix.com/vulnerabilities/web/wordpress-plugin-custom-tables-key-parameter-cross-site-scripting-3-4-4/Advisoryvia CVE List
- vulncheck.com/advisories/custom-tables-wordpress-plugin-3.4.6-reflected-xss-via-iframe-phpAdvisoryvia CVE List
- exploit-db.com/exploits/37482Exploitvia CVE List
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-custom-tables-xss.yamlReferencevia CVE List
- wordpress.org/plugins/custom-tables/Referencevia CVE List