CVE-2012-20003: WordPress Custom Tables XSS Vulnerability

CVE-2012-20003 Overview

CVE-2012-20003 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the Custom Tables plugin for WordPress before version 3.4.6. The flaw resides in iframe.php, which fails to sanitize the key parameter before reflecting its value in the response. Unauthenticated attackers can craft a malicious GET request to /wp-content/plugins/custom-tables/iframe.php with s=1 and a weaponized key value to execute arbitrary JavaScript in a victim's browser session. Successful exploitation enables session cookie theft, credential harvesting through injected forms, and redirection to attacker-controlled infrastructure. The Shadowserver Foundation first observed exploitation evidence on 2023-10-20.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers through a crafted URL, enabling session hijacking and credential theft on affected WordPress sites.

Affected Products

WordPress Custom Tables plugin versions before 3.4.6
WordPress sites with the vulnerable plugin installed and activated
Any publicly reachable iframe.php endpoint under /wp-content/plugins/custom-tables/

Discovery Timeline

2023-10-20 - Shadowserver Foundation observed exploitation evidence in the wild
2026-10-20 - CVE-2012-20003 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2012-20003

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the iframe.php script shipped with the Custom Tables WordPress plugin. The script accepts user-controlled input through the key query parameter and echoes it back into the HTML response without applying output encoding or input sanitization. Because the endpoint is reachable without authentication, any attacker who can trick a user into visiting a crafted URL can execute script content within the context of the hosting WordPress origin.

Reflected XSS in WordPress plugins is particularly impactful when the vulnerable endpoint lives under the same origin as the administrative interface. An attacker who lures a logged-in administrator to a malicious link can execute requests against wp-admin using the victim's cookies, potentially creating new administrator accounts or installing malicious plugins.

Root Cause

The root cause is missing output encoding of the key GET parameter in iframe.php. The plugin inserts the raw value into HTML context without applying functions such as esc_html(), esc_attr(), or wp_kses(). The s=1 parameter acts as a required branching condition that drives the vulnerable code path.

Attack Vector

Exploitation requires an unauthenticated attacker to deliver a crafted URL targeting /wp-content/plugins/custom-tables/iframe.php?s=1&key=<payload> to a victim. User interaction is required: the victim must click the link or load it through an embedded resource. When the browser renders the response, the injected JavaScript executes under the WordPress site's origin, exposing cookies, DOM content, and authenticated session state.

The vulnerability mechanism is documented in the public Exploit-DB #37482 entry and the VulnCheck Advisory on XSS. Detection logic is available in the GitHub Nuclei Template for XSS.

Detection Methods for CVE-2012-20003

Indicators of Compromise

Inbound HTTP GET requests to /wp-content/plugins/custom-tables/iframe.php containing s=1 and script-like payloads in the key parameter
URL-encoded or raw occurrences of <script, onerror=, javascript:, or onload= within query strings targeting the plugin path
Outbound requests from users immediately after visiting a crafted link, suggesting cookie exfiltration to attacker-controlled hosts
Web server access logs showing referrers from phishing domains to the vulnerable iframe.php endpoint

Detection Strategies

Deploy the GitHub Nuclei Template for XSS against WordPress inventory to identify unpatched installations
Create WAF rules that inspect query parameters on /wp-content/plugins/custom-tables/iframe.php for HTML or JavaScript metacharacters
Correlate access logs with authentication events to identify administrators who visited crafted URLs before unexpected account changes

Monitoring Recommendations

Monitor WordPress plugin inventories for Custom Tables installations below version 3.4.6
Alert on HTTP 200 responses from iframe.php where the key parameter contains encoded script tags or event handlers
Review web server telemetry for repeated requests to the vulnerable endpoint from the same source IP, indicating scanning activity

How to Mitigate CVE-2012-20003

Immediate Actions Required

Upgrade the Custom Tables plugin to version 3.4.6 or later on all WordPress hosts
If upgrade is not immediately possible, deactivate and remove the plugin from affected sites
Review web server logs for prior exploitation attempts against iframe.php and rotate administrator session cookies
Audit administrator accounts and installed plugins for unauthorized changes made during the exposure window

Patch Information

The vendor fixed the issue in Custom Tables plugin version 3.4.6. Site owners should update through the WordPress plugin dashboard or by downloading the current release from the WordPress Plugin Custom Tables directory. Additional advisory details are available from WPScan Vulnerability Report and Acunetix Web Vulnerability Analysis.

Workarounds

Block or restrict access to /wp-content/plugins/custom-tables/iframe.php at the web server or WAF layer until patching is complete
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected XSS payloads
Set the HttpOnly and Secure flags on WordPress authentication cookies to limit cookie theft via JavaScript
Require administrators to use separate browser sessions or profiles when accessing WordPress to reduce the impact of malicious links

bash

# Example nginx rule to block exploitation attempts against iframe.php
location = /wp-content/plugins/custom-tables/iframe.php {
    if ($args ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
        return 403;
    }
}