CVE-2012-20005
CVE-2012-20005 · SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 5.1 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
socialfit
- Versiones
- ≥ 0, ≤ 1.2.2: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://www.exploit-db.com/exploits/37481
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-socialfit-xss.yaml
- https://wordpress.org/plugins/socialfit/
- https://www.vulncheck.com/advisories/socialfit-wordpress-plugin-1.2.2-reflected-xss-via-popup-php-msg-parameter
- https://nvd.nist.gov/vuln/detail/CVE-2012-20005