Description
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Published: 2026-10-20
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (Reflected XSS)
Action: Apply Patch
AI Analysis

Impact

The K-news WordPress plugin versions earlier than 1.1.1 contain an unsanitized "ff" query parameter in the fontpicker endpoint that echoes raw user input into option tags. This design flaw permits attackers to inject JavaScript that is executed in the browser of any visitor who accesses the crafted URL, allowing the attacker to steal session cookies and potentially hijack authenticated user accounts or perform other client‑side attacks.

Affected Systems

The vulnerability affects the Carles Reverter K-news WordPress plugin, only for releases before 1.1.1. No additional sub‑versions are documented, so all installs of the plugin with a version number lower than 1.1.1 are considered susceptible.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by sending a crafted GET request to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with a malicious "ff" value; the vulnerability is easy to reproduce and requires only a browser‑based request, making it likely to be abused by automated scanners.

Generated by OpenCVE AI on October 20, 2026 at 21:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the K-news WordPress plugin to version 1.1.1 or later to remove the reflected XSS flaw.
  • If an upgrade cannot be performed immediately, block or remove access to the /wysiwyg/fontpicker/index.php endpoint through .htaccess, a firewall, or WordPress access control to prevent unauthenticated use of the ’ff’ parameter.
  • Apply a web application firewall or implement a strict Content Security Policy to detect and block injected scripts, protecting end users from client‑side injection attacks.

Generated by OpenCVE AI on October 20, 2026 at 21:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Title K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-23T02:04:53.688Z

Reserved: 2026-10-14T20:25:21.968Z

Link: CVE-2012-20004

cve-icon Vulnrichment

Updated: 2026-10-23T02:04:49.869Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:11.907

Modified: 2026-10-23T03:16:29.723

Link: CVE-2012-20004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T22:00:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')