Sassy Social Share CVE-2026-94170

Exploitation requires an attacker to deliver a crafted link/request containing the XSS payload to a victim who must then actively interact with it (UI:R) - the payload is reflected, not stored, so it does not persist and each attack is per-victim. No authentication is required of the attacker (PR:N), but success is limited by: the need for social engineering to get a victim to click, the victim using a session/context where the injected script is meaningful (e.g., an authenticated admin for high-value impact), and the site running Sassy Social Share version 3.3.79 or earlier. The input does not specify which exact plugin parameter or feature is vulnerable, so the precise injectable input point should be confirmed from the Patchstack advisory.

This is a reflected cross-site scripting (CWE-79) flaw in the Sassy Social Share WordPress plugin (affecting versions up to and including 3.3.79), reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity, unauthenticated exploitation (PR:N), but crucially requires user interaction (UI:R) - the victim must be lured into triggering a crafted request/link - which places a meaningful brake on mass, hands-off exploitation. No EPSS score was supplied in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is indicated, so the current real-world signal points to no public exploit identified at time of analysis. The scope change (S:C) and only Low confidentiality/integrity/availability impacts reflect classic reflected-XSS behavior: code executes in the victim's browser session rather than compromising the server directly. Net assessment: this is a moderate, realistically patch-on-cycle issue rather than an emergency - the 7.1 is driven largely by the scope change and network reach, while the mandatory user-interaction and reflected (non-persistent) nature limit it to targeted social-engineering use. Note the data gap: EPSS and POC status are absent from the input, so widespread-exploitation probability could not be independently quantified.

An attacker crafts a malicious URL pointing to a vulnerable Sassy Social Share endpoint with an unsanitized parameter and sends it to a logged-in site administrator or visitor via phishing. When the victim clicks the link, the reflected payload executes JavaScript in their browser session in the context of the WordPress site, enabling session/cookie theft or actions performed as the victim. No public exploit code is indicated, and successful attack depends on the victim interacting with the attacker-supplied link.