CVE-2012-20005
CVE-2012-20005 · SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVSS 5.1 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
socialfit
- Versions
- ≥ 0, ≤ 1.2.2: Affected (semver)
No fix published
Original sources
- https://www.exploit-db.com/exploits/37481
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-socialfit-xss.yaml
- https://wordpress.org/plugins/socialfit/
- https://www.vulncheck.com/advisories/socialfit-wordpress-plugin-1.2.2-reflected-xss-via-popup-php-msg-parameter
- https://nvd.nist.gov/vuln/detail/CVE-2012-20005