CVE-2024-2159: 
WordPress vulnerability analysis and mitigation

The Social Sharing Plugin (Sassy Social Share) WordPress plugin before version 3.3.61 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on April 5, 2024, and was assigned CVE-2024-2159. The issue affects users with contributor role and above who can embed specific shortcodes in posts (WPScan).

The vulnerability stems from improper validation and escaping of shortcode attributes before they are output back in pages or posts where the shortcode is embedded. The issue has been classified as CWE-79 (Cross-site Scripting) with a CVSS score of 4.7 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N (NVD).

This vulnerability allows authenticated users with contributor privileges or higher to perform Stored Cross-Site Scripting attacks. When exploited, it could enable attackers to inject malicious JavaScript code that executes in other users' browsers when viewing the affected pages (WPScan).

A proof of concept exists where an attacker with contributor access can exploit the vulnerability by inserting a malicious shortcode in a post. The example exploit involves using the Sassy_Social_Share shortcode with specially crafted attributes that trigger JavaScript execution when users interact with the Pinterest icon in the sharing bar (WPScan).

The vulnerability has been fixed in version 3.3.61 of the Sassy Social Share plugin. Site administrators should update to this version or later to mitigate the risk (WPScan).