The Social Sharing Plugin – Sassy Social Share includes a flaw where the heateor_mastodon_share parameter is not properly sanitized or escaped. This allows an unauthenticated attacker to embed malicious JavaScript that is reflected back into the page and executed in the victim’s browser. Because the vulnerable code runs client‑side, any user who follows a crafted link can become a victim, potentially resulting in script injection, defacement, or session hijacking. The weakness aligns with CWE‑79.

All WordPress sites that use the heateor Social Sharing Plugin – Sassy Social Share versions up to and including 3.3.75 are affected. Administrators should confirm that their installation falls within the impacted version range and plan an update if necessary.

The CVSS score of 6.1 indicates a medium risk, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The attack vector is client‑side and requires only that a victim opens a URL containing an unsanitized heateor_mastodon_share value, such as a link that an attacker can embed in email, social media posts or malicious sites. Successful exploitation would run arbitrary JavaScript in the victim’s browser, enabling the attacker to steal credentials, redirect users, or otherwise compromise the user’s session.