The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/d7fa9849-c82a-4efd-84b6-9245053975ba/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/d7fa9849-c82a-4efd-84b6-9245053975ba/ | Exploit Third Party Advisory |
Configurations
History
08 May 2025, 19:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/d7fa9849-c82a-4efd-84b6-9245053975ba/ - Exploit, Third Party Advisory | |
| First Time |
Heateor
Heateor sassy Social Share |
21 Nov 2024, 09:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/d7fa9849-c82a-4efd-84b6-9245053975ba/ - |
30 Oct 2024, 14:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
| CWE | CWE-79 |
26 Apr 2024, 12:58
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-26 05:15
Updated : 2025-05-08 19:14
NVD link : CVE-2024-2159
Mitre link : CVE-2024-2159
CVE.ORG link : CVE-2024-2159
JSON object : View
Products Affected
heateor
- sassy_social_share
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')