{"id":"CVE-2021-24746","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-24746","generatedAt":"2026-10-27T22:31:43.813Z","title":"The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the \"Enable 'More' icon\" option is enabled (which is the default setting), leading to a Reflected…","description":"The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the \"Enable 'More' icon\" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.","published":"2022-03-28T18:15:08.000Z","lastModified":"2026-06-17T03:40:50.000Z","status":"Modified","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["heateor/sassy social share"],"epss":{"score":0.02244,"percentile":0.82749,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (2.24%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa","tags":["Exploit","Third Party Advisory"],"source":"contact@wpscan.com"},{"url":"https://wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fa","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-24746","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}