Description
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Web Updates KMU | Custom Tables | < 3.4.6 | 3.4.6 |
References
- EDB-37482 exploit
- WPScan Advisory third-party-advisory
- Acunetix Advisory third-party-advisory
- Nuclei Template technical-description
- WordPress Download Page product
- VulnCheck Advisory: Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php third-party-advisory