Reflected Cross-Site Scripting Vulnerability in Sassy Social Share Plugin for WordPress
CVE-2025-5528
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 June 2025
What is CVE-2025-5528?
The Sassy Social Share plugin for WordPress is exposed to a reflected cross-site scripting vulnerability via the 'heateor_mastodon_share' parameter. Due to inadequate input sanitization and output escaping, this flaw allows unauthenticated attackers to inject arbitrary scripts into web pages. Users can be tricked into executing these scripts by clicking on a malicios link, potentially compromising their security and the integrity of the website.
Affected Version(s)
Social Sharing Plugin – Sassy Social Share * <= 3.3.75