¿Es seguro Sassy Social Share?

Qué hace este plugin

• Slug: sassy-social-share
• 100000+ instalaciones activas

ChatGPTgroksocial mediasocial shareSocial Share Buttons

Estado de mantenimiento

• Última versión conocida: 3.3.79
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

11 CVEs conocidos registrados para Sassy Social Share.

CVE-2025-39404

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.3.73. This is due to insufficient validation on a redirect url. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-11252

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-4971

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4924

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.62 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-2159

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-1989

Update the WordPress Sassy Social Share plugin to the latest available version (at least 3.3.59). Bassem Essam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Sassy Social Share Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.3.59. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-1448

Update the WordPress Sassy Social Share plugin to the latest available version (at least 3.3.57). Richard Telleng (stueotue) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Sassy Social Share Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.3.57. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-4451

The Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via numerous shortcode attributes (such as 'title' and 'width') used in the 'follow_icons_shortcode' and 'sharing_shortcode' functions in versions up to, and including, 3.3.44 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 6 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4	—	Desconocido	< 3.3.4	3.3.4	2022-11-29	✓ corregido en la última versión
CVE-2021-24746	Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.40	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 3.3.40	3.3.40	2022-03-15	✓ corregido en la última versión
CVE-2021-39321	Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.40	Deserialización de datos no confiables	Alta 8,8	< 3.3.40	3.3.40	2021-10-20	✓ corregido en la última versión
—	Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4	—	Desconocido	< 3.3.4	3.3.4	2019-11-18	✓ corregido en la última versión
CVE-2025-5528	Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.76	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 3.3.76	3.3.76	0000-00-00	✓ corregido en la última versión
—	Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4	—	Desconocido	< 3.3.4	3.3.4	—	✓ corregido en la última versión

Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24746

The plugin does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue. Note: Vendor was notified on September 14th, 2021.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2021-39321

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4

Cross-Site Scripting (XSS) vulnerability found by Nicholas Mun in WordPress Sassy Social Share plugin (versions <= 3.3.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2025-5528

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4

AJAX endpoints which returns JSON data has no Content-Type header set, and uses default text/html. Any JSON that has HTML will be rendered as such.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Sassy Social Share actualizado — 3.3.79 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• LocoAI – Auto Translate for Loco Translate — 70000+ instalaciones activas — 98/100 (635) — PHP máx. 8.4
• Chat Button & Custom ChatGPT-Powered Bot by GetButton.io — 20000+ instalaciones activas — 90/100 (175) — PHP máx. 8.4
• Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini — 7000+ instalaciones activas — 100/100 (5) — PHP máx. 8.4
• Hyve Lite – AI Chatbot, ChatGPT-Powered Conversational Support — 7000+ instalaciones activas — 86/100 (6)
• WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — 5000+ instalaciones activas — 94/100 (123)