MEDIUM 5.1 NVD
CVE-2012-20004
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by suppl
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
References
- http://web.archive.org/web/20210213220043/https://www.securityfocus.com/bid/54330/info
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpr
- https://wordpress.org/plugins/knews/
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-knews-multilingual-newslette
- https://www.exploit-db.com/exploits/37484
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-10-20 via NVD.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.