CVE-2024-11252: Sassy Social Share XSS Vulnerability

CVE-2024-11252 Overview

CVE-2024-11252 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Sassy Social Share plugin for WordPress, developed by Heateor. The flaw affects all plugin versions up to and including 3.3.69. It stems from insufficient input sanitization and output escaping on the heateor_mastodon_share parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The weakness is classified under CWE-79.

Critical Impact
Successful exploitation allows attackers to run arbitrary scripts in the context of a targeted user's session, enabling session theft, credential harvesting, and administrative action hijacking on affected WordPress sites.

Affected Products

Heateor Sassy Social Share plugin for WordPress, versions up to and including 3.3.69
WordPress sites using the heateor_mastodon_share share flow
Any deployment exposing the vulnerable public-facing plugin endpoint

Discovery Timeline

2024-11-30 - CVE-2024-11252 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11252

Vulnerability Analysis

The vulnerability is a Reflected XSS in the Sassy Social Share plugin's Mastodon sharing feature. The plugin reads the heateor_mastodon_share request parameter and reflects the value back into the rendered HTML without proper sanitization or output escaping. Because the flaw is reachable without authentication, any visitor of a WordPress site running an affected plugin version can be targeted. Exploitation requires user interaction, typically clicking a crafted URL delivered through phishing, social media, or malicious embeds. Once the payload executes, it runs under the origin of the victim WordPress site.

Root Cause

The root cause is missing input validation and output encoding in the plugin's public share handler. Relevant code paths in public/class-sassy-social-share-public.php (lines 1478 and 1481 in the 3.3.69 tag) accept the heateor_mastodon_share parameter and emit it into the response without escaping HTML metacharacters. This allows attackers to break out of the intended data context and inject <script> tags or event-handler attributes.

Attack Vector

Exploitation is network-based and requires no privileges but does require user interaction. An attacker crafts a URL to the vulnerable endpoint containing a malicious payload in the heateor_mastodon_share parameter. When a victim clicks the link, their browser renders the injected script within the site's origin. Because the scope changes to the browser's same-origin context, attackers can access cookies, hijack sessions, perform actions on behalf of authenticated administrators, or redirect users to attacker-controlled infrastructure. Verified proof-of-concept code is not publicly available; refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for technical details.

Detection Methods for CVE-2024-11252

Indicators of Compromise

HTTP requests to WordPress endpoints containing the heateor_mastodon_share parameter with HTML or JavaScript payloads such as <script>, onerror=, or javascript:.
Referer chains originating from external phishing domains that terminate at pages invoking the plugin's Mastodon share flow.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after visits to plugin-driven pages.

Detection Strategies

Inspect web server and WAF logs for requests where heateor_mastodon_share contains encoded angle brackets, %3Cscript, or common XSS keywords.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script executions on pages served by the plugin.
Correlate reflected parameter values in HTTP responses against known-good baselines to identify anomalous injected markup.

Monitoring Recommendations

Enable request logging with full query-string capture on any WordPress front-end using the Sassy Social Share plugin.
Alert on administrator sessions initiating unusual state-changing actions shortly after visiting share-related URLs.
Track plugin version inventory across managed WordPress sites and flag any installation at or below 3.3.69.

How to Mitigate CVE-2024-11252

Immediate Actions Required

Update the Sassy Social Share plugin to the latest version released after 3.3.69 that addresses the reflected XSS in the heateor_mastodon_share parameter.
Audit WordPress sites for the plugin's presence and confirm the installed version through the WordPress admin dashboard.
Force reauthentication for administrator accounts if suspicious share-endpoint traffic is present in logs.

Patch Information

Heateor addressed the issue in a plugin release following 3.3.69. Site operators should install the latest available version from the WordPress plugin repository. Review the Wordfence Vulnerability Report for the specific fixed version and the code changes in class-sassy-social-share-public.php.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests containing HTML tags or script payloads in the heateor_mastodon_share parameter.
Temporarily deactivate the Sassy Social Share plugin on sites that cannot be patched immediately.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected payloads.

bash

# Example ModSecurity rule to block XSS payloads in the vulnerable parameter
SecRule ARGS:heateor_mastodon_share "@rx (?i)(<script|onerror=|javascript:|<img|<svg)" \
    "id:1002024112,phase:2,deny,status:403,log,msg:'CVE-2024-11252 Sassy Social Share XSS attempt'"