RSS   Podatności dla 'Sassy social share'   RSS

2022-03-28
 
CVE-2021-24746

CWE-79
 

 
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.

 
2021-10-21
 
CVE-2021-39321

CWE-502
 

 
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.

 

 >>> Vendor: Heateor 2 Produkty
Sassy social share
Super socializer


Copyright 2024, cxsecurity.com

 

Back to Top