Security readout for executives and security teams
Plain-English summary
This affects WordPress sites using Kau-Boy Backend Localization Plugin 2.0. A remote authenticated user could trigger cross-site scripting in backend localization code, potentially running script in another user's browser and affecting administrative workflows. It is not listed as known exploited in KEV, and the provided sources identify version 2.0.1 as the fix.
Executive priority
Treat as a moderate-priority cleanup item. It is not supported by supplied evidence as actively exploited, but affected WordPress admin surfaces should be upgraded promptly, especially where many users have backend access.
Technical view
CVE-2012-10014 is a CWE-79 XSS issue in backend_localization.php, involving backend_localization_admin_settings, backend_localization_save_setting, backend_localization_login_form, and localize_backend. The supplied CVSS v2 vector is AV:N/AC:L/Au:S/C:N/I:P/A:N, score 4.0, indicating network reachability, low complexity, authentication required, and partial integrity impact.
Likely exposure
Exposure is limited to WordPress installations running Kau-Boy Backend Localization Plugin version 2.0. The CVSS vector indicates the attacker must be authenticated, reducing broad internet risk but leaving multi-user or delegated-admin WordPress environments exposed.
Exploitation context
The source bundle says remote exploitation is possible, but authentication is required. No CISA KEV listing or supplied reference indicates active exploitation. The available evidence does not establish public weaponization or exploitation in the wild.
Researcher notes
The provided sources identify affected functions and file but do not include detailed exploit prerequisites beyond authenticated remote XSS. Avoid assuming unauthenticated impact. Validation should focus on version, patch presence, and WordPress role exposure.
Mitigation direction
- Upgrade Kau-Boy Backend Localization Plugin from 2.0 to 2.0.1.
- Confirm the patch commit 36f457ee16dd114e510fd91a3ea9fbb3c1f87184 is present.
- Restrict WordPress administrative access to trusted users only.
- Review vendor or plugin repository guidance for any additional hardening steps.
Validation and detection
- Inventory WordPress sites for Kau-Boy Backend Localization Plugin installations.
- Verify installed plugin version is not 2.0.
- Check plugin code provenance against the 2.0.1 release or patch commit.
- Review admin-user activity for unusual localization setting changes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2012-10014 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:N/I:P/A:N82.9Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
4MediumVector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.227232CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.227232CVE reference · signature, permissions-required
- https://github.com/wp-plugins/kau-boys-backend-localization/commit/36f457ee16dd114e510fd91a3ea9fbb3c1f87184CVE reference · patch
- https://github.com/wp-plugins/kau-boys-backend-localization/releases/tag/2.0.1CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.