CVE-2012-20005 SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter

Medium 5.1 Published 20 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2012-20005?

CVE-2012-20005 is a medium-severity vulnerability in Łukasz Więcek SocialFit, published on 20 Oct 2026.

Official description

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Weakness: CWE-79

Which versions are affected by CVE-2012-20005?

How do I fix CVE-2012-20005?

No fix has been published for CVE-2012-20005 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-20005 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-20005 exists.

Sources

Also known as GHSA-9v64-w835-pg55.