CVE-2022-4451

Sassy Social Share < 3.3.45 - Contributor+ Stored XSS

The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

We have discovered 9,157 live websites that are affected by CVE-2022-4451.

Test my site



Affected Software

Product  Sassy Social Share
Category Wordpress Plugins
Vulnerable Domains9,157 live websites (19.20% of Sassy Social Share install base)
Vulnerable Versions
  • from 0 before 3.3.45
Vulnerable Versions Count95 versions ( 76.61% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jan 16, 2023
  • Updated - Aug 3, 2024

Credits

  • Lana Codes (finder)
  • WPScan (coordinator)

CVE-2022-4451 usage by Country

United States3,755 websites


France662 websites
Germany613 websites
Russia410 websites
Italy321 websites
Spain273 websites
GB255 websites
Brazil171 websites
India146 websites
Poland145 websites

CVE-2022-4451 usage by TLD

.com4,055 websites
.ru799 websites
.org458 websites
.it266 websites
.net207 websites
.com.br204 websites
.fr186 websites
.de145 websites
.es138 websites
.com.au130 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-4451

Top websites that are affected by CVE-2022-4451. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.com United States**,***
*************.com United States**,***
*********.pl Poland**,***
****.************.com United States**,***
***********.com United States**,***
********.com United States***,***
*****.**.edu United States***,***
**********.es Spain***,***
*******.***********.com United States***,***
*********.com United States***,***
See full domain list

FAQ

CVE-2022-4451 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Sassy Social Share
A total of 9,157 websites have been identified as vulnerable to CVE-2022-4451, discovered through global website indexing conducted by WebTechSurvey.
Sassy Social Share is susceptible to CVE-2022-4451 vulnerability.
Sassy Social Share versions before 3.3.45 are vulnerable to CVE-2022-4451.
Version 3.3.45 of Sassy Social Share addresses the CVE-2022-4451 security vulnerability.