Medium severity6.1NVD Advisory· Published Mar 28, 2022· Updated Jun 17, 2026

CVE-2021-24746

Description

The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Heateor/Sassy Social Share
cpe:2.3:a:heateor:sassy_social_share:*:*:*:*:*:wordpress:*:*
Range: <3.3.40
WordPress/Wp Social Sharingcpe-rescue
Package: https://wordpress.org/plugins/wp-social-sharing
WordPress/Social Sharing Pluginllm-create
Range: <3.3.40

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/99f4fb32-e312-4059-adaf-f4cbaa92d4fanvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000