CVE-2012-20004 in K-news Plugin
Summary
by MITRE • 10/20/2026
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The K-news plugin for WordPress, prior to version 1.1.1, contains a reflected cross-site scripting vulnerability that poses a significant risk to website administrators and users who interact with the affected component. This security flaw is located within the wysiwyg font picker module, specifically in the file index.php situated at /wp-content/plugins/knews/wysiwyg/fontpicker/index.php. The core technical issue stems from insufficient input validation on the ff parameter, which accepts user-supplied data without proper sanitization or encoding before it is processed by the application logic. Because this endpoint does not require authentication to access, any individual with knowledge of the target URL can attempt exploitation, making the vulnerability particularly dangerous in public-facing environments where unauthenticated actors have direct access to the server's request handling mechanisms.
The operational impact of this vulnerability centers on the ability for attackers to inject malicious client-side scripts into web pages viewed by legitimate users or administrators. When an attacker crafts a GET request with specially constructed values for the ff parameter, the vulnerable application echoes this input directly back into HTML option tags within the response body. This behavior allows the injected script to execute in the context of the victim's browser session whenever they access the compromised page. The primary consequence of such execution is the potential theft of sensitive information, most notably session cookies that authenticate users to the WordPress administration panel or other protected areas of the site. By stealing these credentials, an attacker can hijack active sessions, bypass authentication controls entirely, and gain unauthorized administrative privileges over the entire WordPress installation.
This type of vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a reflected cross-site scripting flaw. The attack vector is classified under ATT&CK technique T1059, specifically subtechnique 007 for JavaScript execution, indicating that the attacker leverages native browser capabilities to run arbitrary code within the victim's environment. Evidence of active exploitation was first observed by the Shadowserver Foundation on October 19, 2023, suggesting that this vulnerability is being actively targeted in the wild rather than remaining a theoretical risk. The presence of such exploits highlights the urgency for immediate remediation, as attackers are already leveraging known weaknesses to compromise systems without needing complex multi-stage attack chains or prior authentication credentials.
To mitigate this risk, site administrators must upgrade the K-news plugin to version 1.1.1 or later, where the input handling logic has been corrected to properly sanitize and encode user-supplied data before rendering it in HTML contexts. If upgrading is not immediately feasible, temporary mitigations should include implementing a Web Application Firewall rule that blocks requests containing suspicious characters within the ff parameter when targeting the specific font picker endpoint. Additionally, enabling strict Content Security Policy headers can help mitigate the impact of successful exploitation by restricting script execution sources and preventing unauthorized data exfiltration via stolen cookies. Regular monitoring for anomalous GET requests to this path is also recommended to detect potential probing or ongoing attack attempts against unpatched instances.