CVE-2024-2159

Sassy Social Share < 3.3.61 - Contributor+ Stored XSS

The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

We have discovered 15,939 live websites that are affected by CVE-2024-2159.

Test my site



Affected Software

Product  Sassy Social Share
Category Wordpress Plugins
Vulnerable Domains15,939 live websites (33.41% of Sassy Social Share install base)
Vulnerable Versions
  • from 0 before 3.3.61
Vulnerable Versions Count111 versions ( 89.52% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Apr 26, 2024
  • Updated - Oct 30, 2024

Credits

  • Dmitrii Ignatyev (finder)
  • WPScan (coordinator)

CVE-2024-2159 usage by Country

United States6,488 websites


France1,170 websites
Germany1,140 websites
Russia562 websites
Italy524 websites
GB503 websites
Spain493 websites
Cyprus297 websites
Brazil270 websites
Poland264 websites

CVE-2024-2159 usage by TLD

.com7,411 websites
.ru919 websites
.org833 websites
.it452 websites
.net438 websites
.com.br344 websites
.fr322 websites
.es240 websites
.de238 websites
.co.uk230 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-2159

Top websites that are affected by CVE-2024-2159. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.com United States**,***
*******.com United States**,***
*****.app Bulgaria**,***
*************.com United States**,***
*********.pl Poland**,***
******.com United States**,***
*****************.com United States**,***
****.************.com United States**,***
***********.com United States**,***
**************.com United States**,***
See full domain list

FAQ

CVE-2024-2159 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Sassy Social Share
A total of 15,939 websites have been identified as vulnerable to CVE-2024-2159, discovered through global website indexing conducted by WebTechSurvey.
Sassy Social Share is susceptible to CVE-2024-2159 vulnerability.
Sassy Social Share versions before 3.3.61 are vulnerable to CVE-2024-2159.
Version 3.3.61 of Sassy Social Share addresses the CVE-2024-2159 security vulnerability.