CVE-2012-20004: K-news WordPress Plugin XSS Vulnerability

CVE-2012-20004 Overview

CVE-2012-20004 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the K-news plugin for WordPress before version 1.1.1. The plugin's fontpicker/index.php script fails to sanitize the ff GET parameter before echoing its value into HTML <option> tags. Unauthenticated attackers can craft malicious URLs that execute arbitrary JavaScript in the context of a victim's browser session. Successful exploitation enables session cookie theft, credential harvesting through injected forms, and redirection to attacker-controlled infrastructure. The Shadowserver Foundation first observed exploitation evidence on 2023-10-19.

Critical Impact
Attackers can hijack administrator sessions and perform actions on behalf of authenticated WordPress users by delivering crafted links to targets.

Affected Products

WordPress K-news (Knews Multilingual Newsletters) plugin versions prior to 1.1.1
The vulnerable endpoint resides at /wp-content/plugins/knews/wysiwyg/fontpicker/index.php
Any WordPress site with the K-news plugin installed and accessible from the internet

Discovery Timeline

2023-10-19 - Exploitation evidence first observed by the Shadowserver Foundation
2026-10-20 - CVE-2012-20004 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2012-20004

Vulnerability Analysis

The K-news plugin ships a WYSIWYG font-picker component at /wp-content/plugins/knews/wysiwyg/fontpicker/index.php. This script accepts a user-controlled ff query string parameter that specifies the pre-selected font. The script reflects the submitted value directly into the HTML response within <option> tags without applying contextual output encoding or input validation.

An attacker injects HTML-breaking characters and JavaScript payloads through the ff parameter. The browser parses the injected markup and executes attacker-supplied script in the origin of the vulnerable WordPress site. Because the endpoint is reachable without authentication, exploitation only requires that a victim click or load a crafted URL.

Root Cause

The root cause is missing output encoding when inserting untrusted input into an HTML context. The plugin treats the ff parameter as a trusted string and concatenates it into server-generated markup. No sanitization routines such as esc_attr() or esc_html() are applied before rendering.

Attack Vector

Exploitation requires a victim to interact with a malicious link, typically delivered through phishing, forum posts, or malvertising. The attacker crafts a GET request to the vulnerable index.php endpoint with a payload supplied in the ff parameter. When the victim's browser loads the response, the injected JavaScript executes in the WordPress site's origin, allowing access to session cookies accessible to script and the authenticated DOM.

Technical details and proof-of-concept payloads are documented in Exploit-DB entry #37484, the VulnCheck advisory, the Acunetix vulnerability analysis, and the Nuclei detection template.

Detection Methods for CVE-2012-20004

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php containing ff= with angle brackets, script, onerror, or URL-encoded equivalents such as %3Cscript%3E
Referrer headers from external domains preceding administrator session anomalies
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after accessing WordPress admin pages

Detection Strategies

Deploy the Nuclei template wp-knews-xss.yaml across external attack surface scanning to identify vulnerable installations
Create web application firewall (WAF) rules that flag reflected script payloads in the ff parameter on the fontpicker endpoint
Correlate web server access logs with downstream events such as session changes, new administrator accounts, or plugin modifications

Monitoring Recommendations

Enable verbose HTTP request logging for /wp-content/plugins/knews/ paths and retain logs for forensic review
Alert on repeated requests to the fontpicker endpoint from the same source IP within short intervals
Monitor WordPress audit logs for administrator actions occurring immediately after inbound requests to the vulnerable endpoint

How to Mitigate CVE-2012-20004

Immediate Actions Required

Upgrade the K-news plugin to version 1.1.1 or later as documented on the WordPress plugin page
If an upgrade is not immediately possible, deactivate and remove the K-news plugin until it can be patched
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

The vendor addressed the vulnerability in K-news plugin version 1.1.1. Site administrators should apply the update through the WordPress plugin management console and verify that the vulnerable fontpicker/index.php endpoint no longer reflects unencoded input. Confirm the installed version via the plugin header after update.

Workarounds

Block external HTTP requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php at the reverse proxy or WAF layer
Implement a Content Security Policy (CSP) that disallows inline script execution to reduce the impact of reflected XSS
Restrict access to WordPress administration pages to known IP ranges to limit the exposure of privileged sessions

bash

# Example nginx configuration to block the vulnerable endpoint
location ~* /wp-content/plugins/knews/wysiwyg/fontpicker/index\.php {
    return 403;
}

# Example Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";