WordPress Plugin Vulnerabilities

TC Custom JavaScript < 1.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS)

Description

A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.

Affects Plugins

Plugin icon
tc-custom-javascript
Fixed in 1.2.2

References

CVE
CVE-2020-14063
URL
https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.3 (high)

Miscellaneous

Original Researcher
Matt Rusnak/Ramuel Gall/Wordfence
Submitter
Ramuel Gall
Verified
No
WPVDB ID
f75d4329-8f4d-41b3-8acb-70ff390636d9

Timeline

Publicly Published
2020-07-21 (about 5 years ago)
Added
2020-07-21 (about 5 years ago)
Last Updated
2020-07-23 (about 5 years ago)

Other

Published
Title
Published
2022-03-01
Title
Delete Old Orders <= 0.2 - Reflected Cross-Site Scripting
Published
2025-04-09
Title
Aria Font <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2021-05-17
Title
WP Prayer < 1.6.2 - Authenticated Stored Cross-Site Scripting (XSS)
Published
2021-08-23
Title
Post Views Counter < 1.3.5 - Authenticated Stored XSS
Published
2024-03-23
Title
Shortcodes Ultimate < 7.0.5 - Contributor+ Stored Cross-Site Scripting via 'note_color' Shortcode