heateor Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

Social Sharing Plugin – Sassy Social Share5 vulnerabilities
Heateor Social Login WordPress2 vulnerabilities
Heateor Login – Social Login Plugin1 vulnerability
social_login1 vulnerability
super_socializer1 vulnerability

heateor vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-5528MEDIUM	Social Sharing Plugin – Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link. CWE-79Jun 7, 2025	CVSS6.1v3.1	EPSS0.207%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-11252MEDIUM	Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CWE-79Nov 30, 2024	CVSS6.1v3.1	EPSS0.853%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-4971MEDIUM	Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CWE-79Oct 16, 20241 related artifact	CVSS6.1v3.1	EPSS15.8%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-1989MEDIUM	Social Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Social_Share' shortcode in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping on user supplied attributes such as 'url'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected … CWE-79Mar 6, 2024	CVSS6.4v3.1	EPSS0.505%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1448MEDIUM	Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.3.56 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Feb 20, 2024	CVSS6.4v3.1	EPSS0.474%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX