CVE-2024-1989: Social Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'SassySocialShare' shortcode in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping on user supplied attributes such as 'url'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1989?
CVE-2024-1989 is considered high severity due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2024-1989?
To fix CVE-2024-1989, update the Sassy Social Share plugin to version 3.3.59 or higher, where the vulnerability is addressed.
What is the impact of CVE-2024-1989 on my WordPress site?
The impact of CVE-2024-1989 could lead to unauthorized execution of malicious scripts on your site, potentially compromising user data.
Which versions are affected by CVE-2024-1989?
CVE-2024-1989 affects all versions of the Sassy Social Share plugin up to and including 3.3.58.
Is my website vulnerable if I am using an outdated version of the Sassy Social Share plugin?
Yes, if you are using an outdated version up to 3.3.58, your website is vulnerable to CVE-2024-1989.