# CVE-2012-20003: WordPress Custom Tables reflected XSS in iframe.php

Source: https://junglewise.ai/threats/cve-2012-20003-custom-tables-plugin-for-wordpress-before-3-4-6-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2012-20003 · Severity: medium · CVSS 6.1 · Published 2026-10-20

The Custom Tables plugin for WordPress before version 3.4.6 contains a reflected cross-site scripting vulnerability in its iframe.php file. An attacker can craft a malicious URL with an unsanitized 'key' parameter to inject and execute scripts in a visitor's browser, potentially stealing session cookies or hijacking accounts without any user authentication required.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2012-20003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2012-20003 being exploited in the wild.

**How severe is CVE-2012-20003?** Medium severity, with a CVSS score of 6.1, published 20 October 2026.

**Which products and versions are affected?** WordPress.org Custom Tables before 3.4.6.

**Is there a fix for CVE-2012-20003?** Yes: fixed in 3.4.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2012-20003 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2012-20003?** Check whether you run WordPress.org Custom Tables at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.4.6

## Technical details

The vulnerability is a reflected XSS flaw in the iframe.php file where the 'key' parameter is not properly sanitized before output. An unauthenticated attacker can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and arbitrary JavaScript in the key parameter, exploiting a network-based attack vector requiring only user interaction (victim visiting a link). The attacker gains the ability to execute arbitrary JavaScript in the victim's browser context.

## Affected products

- WordPress.org Custom Tables before 3.4.6

## Timeline

- 2026-10-20: disclosed
- 2023-10-20: exploited: exploitation evidence observed by Shadowserver Foundation

## References

- [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-custom-tables-xss.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-custom-tables-xss.yaml)
- [https://wordpress.org/plugins/custom-tables/](https://wordpress.org/plugins/custom-tables/)