CVE-2025-5528: 
WordPress vulnerability analysis and mitigation

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in versions up to and including 3.3.75. This vulnerability was discovered and reported by Wordfence, with the CVE identifier CVE-2025-5528 being assigned on June 7, 2025 (NVD, Wiz).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's handling of the heateor_mastodon_share parameter. The issue has been assigned a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. This can lead to potential client-side attacks and compromise of user data within the browser context (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. No public exploits have been reported at the time of disclosure (Wiz).

Users should update to a version newer than 3.3.75 when available. The vulnerability affects all versions up to and including 3.3.75 (NVD).