WordPress plugin
Social Sharing Plugin – Sassy Social Share security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High2
- Medium10
- Low0
All Social Sharing Plugin – Sassy Social Share vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.3.79No patch available | CVE-2026-94170 | |
| Medium6.1 | Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter ≤3.3.75Update to 3.3.76 | CVE-2025-5528 | |
| Medium6.1 | Open Redirect ≤3.3.73Update to 3.3.74 | CVE-2025-39404 | |
| Medium6.1 | Reflected Cross-Site Scripting via heateor_mastodon_share Parameter ≤3.3.69Update to 3.3.70 | CVE-2024-11252 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤3.3.62Update to 3.3.63 | CVE-2024-4924 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤3.3.60Update to 3.3.61 | CVE-2024-2159 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤3.3.58Update to 3.3.59 | CVE-2024-1989 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.3.56Update to 3.3.57 | CVE-2024-1448 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.3.44Update to 3.3.45 | CVE-2022-4451 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.3.3Update to 3.3.4 | CVE-2022-4971 | |
| Medium6.1 | Reflected Cross-Site Scripting <3.3.40Update to 3.3.40 | CVE-2021-24746 | |
| High8.8 | Object Injection 3.3.23 – 3.3.23Update to 3.3.24 | CVE-2021-39321 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.3.79No patch available
- Medium6.1Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
≤3.3.75Update to 3.3.76
- Medium6.1Open Redirect
≤3.3.73Update to 3.3.74
- Medium6.1Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
≤3.3.69Update to 3.3.70
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.3.62Update to 3.3.63
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.3.60Update to 3.3.61
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.3.58Update to 3.3.59
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.3.56Update to 3.3.57
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.3.44Update to 3.3.45
- Medium6.1Reflected Cross-Site Scripting
≤3.3.3Update to 3.3.4
- Medium6.1Reflected Cross-Site Scripting
<3.3.40Update to 3.3.40
- High8.8Object Injection
3.3.23 – 3.3.23Update to 3.3.24
Social Sharing Plugin – Sassy Social Share: common questions
Does Social Sharing Plugin – Sassy Social Share have known vulnerabilities?
Yes. VulnCrest Radar lists 12 known vulnerabilities in Social Sharing Plugin – Sassy Social Share: 2 high, 10 medium. At least one is not fixed in the latest version.
How do I check which version of Social Sharing Plugin – Sassy Social Share I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Social Sharing Plugin – Sassy Social Share vulnerability?
CVE-2026-94170, published Oct 4, 2026: Social Sharing Plugin – Sassy Social Share <= 3.3.79 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Social Sharing Plugin – Sassy Social Share vulnerability listed in CISA KEV?
No. None of the known Social Sharing Plugin – Sassy Social Share vulnerabilities is currently listed in the CISA KEV catalog.