Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-5528: Sassy Social Share Plugin for WordPress Allows Attackers to Inject Malicious Code

CVE-2025-5528 · published 1 year ago

Summary

The Sassy Social Share plugin for WordPress is not properly protecting against malicious code injection. This could allow attackers to trick users into doing something they shouldn't, such as clicking on a link. Update the plugin to a version newer than 3.3.75 to fix this issue.

What to do

Update heateor sassy_social_share to version 3.3.76 or later.

Affected software

Vendor	Product	Affected versions
heateor	sassy_social_share	< 3.3.76 `cpe:2.3:a:heateor:sassy_social_share::::::wordpress::*`

Original advisory text

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.

References

https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.75/public... Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/99e922ec-d40a-47e7-a10... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published7 Jun 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-5528 · NVD

Track software like this

Free during beta