CVE-2020-14063

A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.

• CWE-79

• https://wordpress.org/plugins/tc-custom-javascript/#developersRelease Notes, Third Party Advisory
• https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/Exploit, Third Party Advisory
• https://wordpress.org/plugins/tc-custom-javascript/#developersRelease Notes, Third Party Advisory
• https://www.wordfence.com/blog/2020/07/high-severity-vulnerability-patched-in-tc-custom-javascript/Exploit, Third Party Advisory

Published

Jul 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14058An issue was discovered in Squid before 4.12 and 5.x before …7.5
• CVE-2020-14059An issue was discovered in Squid 5.x before 5.0.3. Due to an…6.5
• CVE-2020-1406An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-14060FasterXML jackson-databind 2.x before 2.9.10.5 mishandles th…8.1
• CVE-2020-14061FasterXML jackson-databind 2.x before 2.9.10.5 mishandles th…8.1
• CVE-2020-14062FasterXML jackson-databind 2.x before 2.9.10.5 mishandles th…8.1
• CVE-2020-14064IceWarp Email Server 12.3.0.1 has Incorrect Access Control f…6.5
• CVE-2020-14065IceWarp Email Server 12.3.0.1 allows remote attackers to upl…6.5
• CVE-2020-14066IceWarp Email Server 12.3.0.1 allows remote attackers to upl…8.8
• CVE-2020-14067The install_from_hash functionality in Navigate CMS 2.9 does…9.8
• CVE-2020-14068An issue was discovered in MK-AUTH 19.01. The web login func…9.8
• CVE-2020-14069An issue was discovered in MK-AUTH 19.01. There are SQL inje…6.8