vulnerability

WordPress Plugin: tc-custom-javascript: CVE-2020-14063: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:P/A:N)

Published

Jul 21, 2020

Added

May 15, 2025

Modified

May 5, 2026

Description

A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.

Solution

tc-custom-javascript-plugin-cve-2020-14063

References

https://www.cve.org/CVERecord?id=CVE-2020-14063
https://www.wordfence.com/threat-intel/vulnerabilities/id/5574f8ab-74b7-4f6c-b8db-901cb6e45cfb?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6222
CVE-2020-14063
https://attackerkb.com/topics/CVE-2020-14063
CWE-79
EUVD-EUVD-2020-6222

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report