Description
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Published: 2026-10-20
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch Immediately
AI Analysis

Impact

The SocialFit WordPress plugin v1.2.2 contains an unsanitized GET parameter named msg in popup.php. An unauthenticated attacker can embed arbitrary JavaScript in this parameter, which is then rendered in the browser of any user who visits the crafted URL. This reflected XSS can be used to steal session cookies, deface the site or elevate a malicious payload, compromising confidentiality and integrity of user data.

Affected Systems

The vulnerability affects the SocialFit plugin developed by Łukasz Więcek, specifically version 1.2.2, which is deployed on any WordPress installation that includes this plugin.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity without affecting authentication or network segments. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, yet its attack vector is remote via a simple GET request, making it trivially exploitable for any site owner who does not patch the plugin. The first exploitation evidence was logged in late October 2023, confirming that attackers have already exercised this flaw.

Generated by OpenCVE AI on October 20, 2026 at 21:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the SocialFit plugin to the latest version if one is available, or uninstall the plugin entirely if it is not required.
  • Modify wp-content/plugins/socialfit/popup.php to apply strict input sanitization on the msg parameter, e.g., use filter_input or wp_kses to allow only safe content.
  • Add a web application firewall rule that blocks requests containing script tags or common XSS payloads in the msg parameter until an official patch is applied.

Generated by OpenCVE AI on October 20, 2026 at 21:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions socialfit
Łukasz Więcek
Łukasz Więcek socialfit
Vendors & Products Wordpress-extensions
Wordpress-extensions socialfit
Łukasz Więcek
Łukasz Więcek socialfit

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and malicious msg values to execute script and steal session cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Title SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Wordpress-extensions Socialfit
Łukasz Więcek Socialfit
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T11:03:35.133Z

Reserved: 2026-10-14T20:25:21.968Z

Link: CVE-2012-20005

cve-icon Vulnrichment

Updated: 2026-10-27T11:03:29.773Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:12.077

Modified: 2026-10-27T12:16:35.130

Link: CVE-2012-20005

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:21:00Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')