CVE-2022-4971
Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting
Vexday Risk Score
33Atención
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
CVSS 6.1EPSS 15.4%KEV nãoPoC —Nuclei simMetasploit —Patch —
Ciclo de vida
16 oct 2024Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
heateor · Social Sharing Plugin – Sassy Social Share¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →