CVE-2022-4971

MEDIUMNuclei

Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4971 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Sassy Social Share plugin for WordPress

Browse Team Heateor / Sassy Social Share plugin for WordPress
VulnCheckVersion data not supplied

Social Sharing Plugin – Sassy Social Share

Browse heateor / Social Sharing Plugin – Sassy Social Share

Default status: unaffected

CVE ListThrough 3.3.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMSassy Social Share <= 3.3.3 - Cross-Site ScriptingCVSS 6.1

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Impact

Unauthenticated attackers can inject malicious JavaScript through the urls parameter in the sharing count AJAX action, potentially stealing WordPress user sessions and performing actions on behalf of authenticated users.

Remediation

Update Sassy Social Share plugin to a version newer than 3.3.3 that properly sanitizes the urls parameter and encodes output in the AJAX action.

WeaknessesCWE-79
Authorspopcorn94
Template tagswpscancvecve2022wordpresswp-pluginwpsassy-social-sharexssauthenticatedvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:*
Shodan: http.html:"/wp-content/plugins/sassy-social-share"
FOFA: body=/wp-content/plugins/sassy-social-share/
Google: inurl:"/wp-content/plugins/sassy-social-share"
https://www.wordfence.com/threat-intel/vulnerabilities/id/85277960-2bba-4cd7-9f4c-e04f6743b96c?source=cve https://wpscan.com/vulnerability/4631519b-2060-43a0-b69b-b3d7ed94c705/ https://nvd.nist.gov/vuln/detail/CVE-2022-4971

Source: ProjectDiscovery

References

3