Live › vulnerability › CVE-2012-20005
Go to dashboardThe SocialFit WordPress plugin through 1.2.2 echoes the msg parameter of popup.php without sanitizing it, so a crafted link runs attacker script in the victim's browser. An attacker can use this to steal session cookies from anyone who opens the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SocialFit WordPress plugin version 1.2.2 or earlier that still have popup.php reachable. Sites without the plugin installed are not affected. Exploitation requires a victim to open a crafted link, so an attacker needs no account.
No product ranges from the sources yet.
socialfit directory under wp-content/plugins/ and read its version in the plugin headerwp-content/plugins/socialfit/popup.php exists on the siteEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2012-20005")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.