CVE-2021-24746 Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting

2022-03-2817:20:47

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

43.5%

JSON

The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the “Enable ‘More’ icon” option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.

CNA Affected

[
  {
    "product": "Social Sharing Plugin – Sassy Social Share",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.3.40",
        "status": "affected",
        "version": "3.3.40",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa

0.001 Low

EPSS

Percentile

43.5%

JSON

Related for CVELIST:CVE-2021-24746