VulnerabilityModified
CVE-2021-24746
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected…
MEDIUM 6.1EPSS 2.24%
Does this matter?
Lower severity and a low EPSS score (2.24%). Track it; it rarely justifies an emergency change on its own.
Description
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 2.24% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- heateor/sassy social share
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4faExploit, Third Party Advisory
- https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4faExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.