Team Heateor Vulnerabilities and Affected Products
Vulnerabilities associated with Sassy Social Share plugin for WordPress.
Products
Clear product- Fancy Comments WordPress2 vulnerabilities
- Heateor Social Login2 vulnerabilities
- Super Socializer2 vulnerabilities
- Heateor Social Login WordPress1 vulnerability
- Sassy Social Share plugin for WordPress1 vulnerability
- WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-4971MEDIUM | Sassy Social Share <= 3.3.3 - Reflected Cross-Site ScriptingThe Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | CVSS6.1v3.1 | EPSS15.8% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |