Description
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Published: 2026-10-20
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting
Action: Update Plugin
AI Analysis

Impact

The Custom Tables WordPress plugin, before version 3.4.6, contains a reflected cross‑site scripting flaw that allows an unauthenticated attacker to inject arbitrary JavaScript via the unsanitized 'key' parameter in iframe.php. By sending a crafted GET request containing a malicious value for key, the attacker can cause victim browsers to execute the script, which may steal session cookies or perform other client‑side attacks. This is a typical input validation issue identified as CWE‑79.

Affected Systems

Vulnerable installations are those running the Custom Tables plugin from the Web Updates KMU vendor, on WordPress sites that have a plugin version older than 3.4.6. The vulnerability was found in the iframe.php component of the plugin.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate severity, and no EPSS score is currently available. The vulnerability is not listed in CISA’s KEV database. Exploitation requires only an unauthenticated HTTP GET request and is feasible for any user who can visit a URL, making the attack vector straightforward. Given the lack of an official workaround and the moderate CVSS, the overall risk is that any website exposed to the public could suffer XSS attacks that compromise user sessions.

Generated by OpenCVE AI on October 20, 2026 at 21:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Custom Tables plugin to version 3.4.6 or later.
  • If an upgrade is not immediately possible, disable or block access to /wp-content/plugins/custom-tables/iframe.php using web‑server rules or a firewall so that only administrators can reach it.
  • Implement or update a web‑application firewall rule to sanitize or reject malicious input for the 'key' parameter in requests to iframe.php.

Generated by OpenCVE AI on October 20, 2026 at 21:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Title Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-23T15:25:44.876Z

Reserved: 2026-10-14T20:25:21.968Z

Link: CVE-2012-20003

cve-icon Vulnrichment

Updated: 2026-10-23T15:25:40.478Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:11.730

Modified: 2026-10-23T16:16:48.887

Link: CVE-2012-20003

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T21:45:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')