CVE-2020-14063: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in the TC Custom JavaScript WordPress plugin versions before 1.2.2. The vulnerability, identified as CVE-2020-14063, was discovered in June 2020 and allows unauthenticated remote attackers to inject arbitrary JavaScript code via the tccj-content parameter (WPScan, Wordfence).

The vulnerability is classified as a stored XSS vulnerability with a CVSS score of 8.3 (high severity). It is categorized under OWASP Top 10 as A7: Cross-Site Scripting (XSS) and CWE-79. The vulnerability allows attackers to inject malicious JavaScript code that gets stored on the server and is subsequently displayed in the page footer of every front-end page, executing in visitors' browsers (WPScan).

When exploited, the vulnerability allows the injected JavaScript code to be executed in the browsers of all visitors to the affected website. Since the malicious code is stored on the server and executed on every front-end page, it could potentially affect all visitors to the website, making it particularly dangerous for site owners and their users (Wordfence).

The vulnerability is particularly severe as it requires no authentication to exploit, meaning any remote attacker can inject malicious JavaScript code. The exploit can be triggered through the tccj-content parameter, making it relatively straightforward for attackers to execute (WPScan).

The vulnerability was patched in version 1.2.2 of the TC Custom JavaScript plugin. Website administrators are strongly advised to update to this version or later to protect against this security issue. The patch includes updated security checking mechanisms to prevent unauthorized JavaScript injection (WordPress Plugin).