Reflected Cross-Site Scripting Vulnerability Affects WordPress Users
CVE-2022-4971

6.1MEDIUM

Key Information:

Vendor
Wordpress
Vendor
CVE Published:
16 October 2024

Summary

The Sassy Social Share plugin for WordPress is susceptible to a Reflected Cross-Site Scripting flaw through the 'urls' parameter during the 'heateor_sss_sharing_count' AJAX action. The vulnerability arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary scripts into web pages. If a user interacts with a manipulated element, such as clicking a link, these scripts may execute in their browser context, potentially leading to malicious actions and compromised user data. Users and administrators should ensure they are running the latest version of the plugin to mitigate this risk.

Affected Version(s)

Social Sharing Plugin – Sassy Social Share * <= 3.3.3

References

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicholas Mun
.
🍪 This website uses cookies, like every other website on the internet 😕 By using our website, you consent to the use of cookies.