CVE-2012-20003

🗓️ 20 Oct 2026 20:31:19Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Unauthenticated reflected XSS in Custom Tables for WordPress via iframe.php 'key' parameter.

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2012-20003	20 Oct 202620:39	–	circl
Cvelist	CVE-2012-20003 Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php	20 Oct 202620:31	–	cvelist
EUVD	EUVD-2012-6611	20 Oct 202620:31	–	euvd
NVD	CVE-2012-20003	20 Oct 202621:17	–	nvd
Positive Technologies	PT-2026-118672	20 Oct 202600:00	–	ptsecurity
VulnCheck KEV	VulnCheck KEV: CVE-2012-20003	20 Oct 202600:00	–	vulncheck_kev

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Web Updates KMU",
    "product": "Custom Tables",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "3.4.6"
      }
    ]
  }
]

Source	Link
wordpress	www.wordpress.org/plugins/custom-tables/
acunetix	www.acunetix.com/vulnerabilities/web/wordpress-plugin-custom-tables-key-parameter-cross-site-scripting-3-4-4/
github	www.github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-custom-tables-xss.yaml
exploit-db	www.exploit-db.com/exploits/37482
wpscan	www.wpscan.com/vulnerability/211a4286-4747-4b62-acc3-fd9a57b06252
vulncheck	www.vulncheck.com/advisories/custom-tables-wordpress-plugin-3.4.6-reflected-xss-via-iframe-php

Parameter	Position	Path	Description	CWE
key	query param	/wp-content/plugins/custom-tables/iframe.php	Reflected cross-site scripting vulnerability in the Custom Tables plugin where the 'key' parameter is unsanitized.	CWE-79

20 Oct 2026 21:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.1

CVSS 3.16.1

EPSS0.00215