CVE-2025-5528: fallo de gravedad media en heateor Social Sharing Plugin – Sassy Social…
Social Sharing Plugin – Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.2%
probabilidad de explotación
0.2%top 86% de las CVE
explotación observada
noninguna fuente lo reporta
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
heateor · Social Sharing Plugin – Sassy Social ShareCVEs relacionadas — heateor Social Sharing Plugin – Sassy Social…
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-4971MEDIUMSassy Social Share <= 3.3.3 - Reflected Cross-Site ScriptingEPSS 17.3%CVE-2024-11252MEDIUMSocial Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share ParameterEPSS 0.9%CVE-2024-1989MEDIUMSocial Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-1448MEDIUMSassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%