All vulnerabilities
CVE-2012-20004

K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

Carles Reverter K-news
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 23 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.1.1Fixed versionCVE List
Published20 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Text from CVE List

Affected versions 1

  • K-newsaffected: all versions before 1.1.1CVE List

References 5