Medium 6.1Published Oct 20, 2026

CVE-2012-20004K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

Updated under an hour ago (2026-10-21 13:30 UTC)

Does this affect you?

It affects Carles Reverter K-news. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Carles Reverter K-news

Exploited in the last 30 days

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/fontpicker/index.php with malicious 'ff' values echoed into option tags to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS: 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Received
Record last updated: Oct 20, 2026
First seen by InfoSec Signals: Oct 20, 2026

Affected products

Affected products

Carles Reverter K-news carles_reverter:k_news (from the name)	before 1.1.1	CNA record

References

https://www.exploit-db.com/exploits/37484exploit
http://web.archive.org/web/20210213220043/https://www.securityfocus.com/bid/54330/infotechnical-description
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-knews-multilingual-newsletters-ff-parameter-cross-site-scripting-1-1-0third-party-advisory
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-knews-xss.yamltechnical-description
https://wordpress.org/plugins/knews/product
https://www.vulncheck.com/advisories/k-news-wordpress-plugin-1.1.1-reflected-xss-via-fontpicker-index-php-ff-parameterthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.