Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting
Priority LOW 32CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
Why it matters now
EPSS 0.02244 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Social Sharing Plugin – Sassy Social Share (Unknown): 3.3.40
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Social Sharing Plugin – Sassy Social Share | 3.3.40 to before 3.3.40 | 3.3.40 | Patch available | CNA |
- Social Sharing Plugin – Sassy Social Share VendorUnknown Affected 3.3.40 to before 3.3.40 Fixed in 3.3.40 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:* | before 3.3.40 | Vulnerable | Team Heateor |
- cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:* Versions before 3.3.40 Vulnerable ·Team Heateor
Remediation
- Fix · CNA Social Sharing Plugin – Sassy Social Share (Unknown) Fixed in 3.3.40
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24746
- 2026-10-03 Alias added: GHSA-rqh2-pcw6-q628
References
More Team Heateor Sassy Social Share vulnerabilities
- TI-2022-04068 Sassy Social Share < 3.3.45 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-02007 Sassy Social Share < 3.3.61 - Contributor+ Stored XSS CVSS 3.1MEDIUM 4.7
- TI-2022-04559 Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2021-16693 Sassy Social Share 3.3.23 PHP Object Injection CVSS 3.1HIGH 8.8
- TI-2024-10424 Cross-site scripting in Team Heateor Social Sharing Plugin – Sassy Social Share CVSS 3.1MEDIUM 6.1
- TI-2024-01851 Cross-site scripting in Team Heateor Social Sharing Plugin – Sassy Social Share CVSS 3.1MEDIUM 6.4
Sources
- CVE-2021-24746 · CVE Program
- CVE-2021-24746 · NVD
- FIRST EPSS
- GHSA-rqh2-pcw6-q628 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences