CVE-2012-20004

The K-news plugin for WordPress (versions before 1.1.1 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the failure to sanitize input provided through the 'ff' parameter in the /wp-content/plugins/knews/wysiwyg/fontpicker/index.php file. Unauthenticated attackers ...