CVE-2021-24746: Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24746?
CVE-2021-24746 is a vulnerability in the Social Sharing Plugin WordPress plugin before version 3.3.40 that allows for a Reflected Cross-Site Scripting (XSS) attack.
What is the severity of CVE-2021-24746?
The severity of CVE-2021-24746 is medium with a CVSS score of 6.1.
How does CVE-2021-24746 affect the Social Sharing Plugin WordPress plugin?
CVE-2021-24746 affects the Social Sharing Plugin WordPress plugin versions up to and excluding 3.3.40.
How can I fix CVE-2021-24746?
To fix CVE-2021-24746, update the Social Sharing Plugin WordPress plugin to version 3.3.40 or later.
What is a Reflected Cross-Site Scripting (XSS) attack?
A Reflected Cross-Site Scripting (XSS) attack is a type of security vulnerability where an attacker injects malicious scripts into a website, which are then executed by the victim's browser.