/Vulnerability Library

Sassy Social Share <= 3.3.3 - Cross-Site Scripting

CVE-2022-4971
Verified

Description

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity

Medium

CVSS Score

6.1

Exploit Probability

17%

Affected Product

sassy_social_share

Published Date

September 8, 2025

Template Author

popcorn94

CVE-2022-4971.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2022-4971
CWE ID:
cwe-79

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/85277960-2bba-4cd7-9f4c-e04f6743b96c?source=cvehttps://wpscan.com/vulnerability/4631519b-2060-43a0-b69b-b3d7ed94c705/https://nvd.nist.gov/vuln/detail/CVE-2022-4971

Remediation Steps

Update Sassy Social Share plugin to a version newer than 3.3.3 that properly sanitizes the urls parameter and encodes output in the AJAX action.