A reflected cross‑site scripting flaw exists in Heateor Support Sassy Social Share. Improper neutralization of user input during web page generation enables an attacker to inject arbitrary script that will execute in the browser of any visitor who accesses a specially crafted URL or submits a manipulated form. This can lead to session hijacking, theft of credentials or other sensitive data, and site defacement.

The vulnerability is present in every installation of the WordPress Sassy Social Share plugin up to and including version 3.3.79. Any WordPress site that has that plugin installed and the plugin enabled is susceptible, regardless of the WordPress core version or other plugins.

The CVSS score of 7.1 places the flaw in the high‑severity range, indicating that exploitation could have a significant impact on confidentiality, integrity, and availability. The EPSS is not available, but the lack of KEV listing does not reduce the potential for exploitation—reflected XSS is a well‑known attack surface. While the description does not detail an explicit user or network level prerequisite, the likely attack vector is a crafted web request (for example, a malicious link) that is reflected in the page output. An attacker would need a victim to click the link or otherwise submit the payload to trigger the injection.