CVE-2024-1448: Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting

Q: What is the severity of CVE-2024-1448?

CVE-2024-1448 is classified as a high severity stored Cross-Site Scripting vulnerability.

Q: How do I fix CVE-2024-1448?

To fix CVE-2024-1448, update the Sassy Social Share plugin to a version higher than 3.3.56.

Q: Which versions are affected by CVE-2024-1448?

CVE-2024-1448 affects all versions of the Sassy Social Share plugin up to and including 3.3.56.

Q: What kind of vulnerability is CVE-2024-1448?

CVE-2024-1448 is a stored Cross-Site Scripting (XSS) vulnerability.

Q: Who is the vendor for the vulnerable plugin in CVE-2024-1448?

The vendor for the vulnerable plugin in CVE-2024-1448 is Heateor.

Published Feb 20, 2024

Updated

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.3.56 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected Software

1 affected component

Heateor Sassy Social Share WordPress<=3.3.56

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038227%40sassy-social-share%2Ftrunk&old=2996153%40sassy-social-share%2Ftrunk&sfp_email=&sfph_mail=#file8

Event History

Feb 20, 2024

CVE Published

via MITRE·06:56 PM

Data Sourced

via MITRE·06:56 PM

DescriptionSeverityWeakness

Feb 29, 2024

Data Sourced

via NVD·01:43 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-1448?

CVE-2024-1448 is classified as a high severity stored Cross-Site Scripting vulnerability.

How do I fix CVE-2024-1448?