Stored Cross-Site Scripting in Sassy Social Share Plugin for WordPress
CVE-2024-1448
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 29 February 2024
What is CVE-2024-1448?
The Sassy Social Share plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of user-supplied attributes in its shortcode functionality. This vulnerability can be exploited by authenticated users with contributor-level permissions or higher. Attackers can inject malicious scripts, which will execute whenever a user accesses the affected pages, posing serious security risks to the site's users and data integrity.
Affected Version(s)
Social Sharing Plugin – Sassy Social Share * <= 3.3.56