CVE-2012-20003 in Custom Tables Plugin
Summary
by MITRE • 10/20/2026
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The Custom Tables plugin for WordPress, prior to version 3.4.6, contains a critical reflected cross-site scripting vulnerability that poses significant risks to website administrators and users who interact with affected instances. This flaw resides specifically within the iframe.php component of the plugin, where input validation mechanisms are insufficiently rigorous. The core technical deficiency involves the lack of proper sanitization or encoding applied to the key parameter when it is processed by the server-side script. Because this parameter is reflected directly back into the HTML response without adequate filtering, any malicious content injected via this vector remains executable within the context of the victim's browser session. This architectural oversight allows external actors to manipulate the output stream in a way that bypasses standard security controls typically enforced by modern browsers against certain types of injection attacks.
From an operational perspective, this vulnerability enables unauthenticated attackers to execute arbitrary JavaScript code on behalf of any user who visits a crafted URL containing the malicious payload. The exploitation mechanism is straightforward and does not require prior authentication or complex social engineering tactics beyond luring a victim to click a link. By constructing a GET request directed at /wp-content/plugins/custom-tables/iframe.php with specific parameters such as s=1 alongside a carefully constructed key value, an attacker can inject script tags that run immediately upon page load. The primary impact of this execution is the compromise of user session integrity. Attackers can access sensitive data stored in cookies, including authentication tokens and session identifiers, which may lead to account takeover or unauthorized administrative actions if the victim holds elevated privileges within the WordPress environment.
The severity of this issue is further underscored by real-world exploitation evidence observed by the Shadowserver Foundation on October 20, 2023. This observation indicates that active campaigns are already leveraging this vulnerability in the wild, moving it from a theoretical risk to an immediate threat requiring urgent remediation. The presence of such exploit activity suggests that automated scanners and malicious actors are actively probing for instances of vulnerable WordPress installations using custom tables plugins. Organizations relying on these older versions face heightened exposure to data theft and potential lateral movement within their internal networks if administrative credentials are compromised through this vector.
To mitigate the risks associated with CVE-2023-XXXX, immediate action is required to update the Custom Tables plugin to version 3.4.6 or later, where the input sanitization logic has been corrected. Until an upgrade can be performed, administrators should consider implementing web application firewall rules that detect and block requests containing suspicious patterns in the key parameter of iframe.php endpoints. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting script execution sources, although this is a compensatory control rather than a fix for the underlying code defect. Regularly auditing plugin versions and applying security patches promptly are essential practices to maintain the integrity of WordPress-based infrastructure against known vulnerabilities like CWE-79 Improper Neutralization of Input During Web Page Generation which classifies this type of reflected cross-site scripting flaw.