CVE-2024-11252: Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateormastodonshare parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11252?
CVE-2024-11252 is considered a high severity vulnerability due to the potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-11252?
To fix CVE-2024-11252, update the Sassy Social Share plugin to version 3.3.70 or later.
Which versions of the Sassy Social Share plugin are affected by CVE-2024-11252?
All versions of the Sassy Social Share plugin up to and including 3.3.69 are affected by CVE-2024-11252.
What type of vulnerability is CVE-2024-11252?
CVE-2024-11252 is a reflected cross-site scripting vulnerability that exploits insufficient input sanitization in the plugin.
Can CVE-2024-11252 lead to data theft?
Yes, CVE-2024-11252 can lead to data theft and other malicious activities if exploited by an attacker.