PLUGIN SECURITY
Is Sassy Social Share safe?
URL Shortify helps you beautify, manage, share & cloak any links on or off your WordPress website. Create links using your domain name!
What this plugin does
- Slug:
sassy-social-share - Author: KaizenCoders
- 10000+ active installs
- 94/100 rating (169 reviews on wordpress.org)
- 667547 all-time downloads
- On WordPress.org since 2020-05-07
affiliate linkscloakinglink brandingshort linksurl shortener
Maintenance status
- Latest known version: 3.3.79
- Last updated: 2026-10-12 5:28am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 5.6+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
12 known CVEs on file for Sassy Social Share.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Social Sharing Plugin – Sassy Social Share [sassy-social-share] <= 3.3.79 (unfixed + closed) | — | High 7.1 | < 3.3.79 | 3.3.79 | 2026-10-09 | ✓ fixed in latest |
| CVE-2025-39404 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.74 (closed) | URL Redirection to Untrusted Site ('Open Redirect') | Medium 4.7 | < 3.3.74 | 3.3.74 | 2025-04-17 | ✓ fixed in latest |
| CVE-2024-11252 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.70 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.3.70 | 3.3.70 | 2024-11-29 | ✓ fixed in latest |
| CVE-2024-4924 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.63 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.3.63 | 3.3.63 | 2024-05-22 | ✓ fixed in latest |
| CVE-2024-2159 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.61 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.7 | < 3.3.61 | 3.3.61 | 2024-04-05 | ✓ fixed in latest |
| CVE-2024-1989 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.59 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.3.59 | 3.3.59 | 2024-03-05 | ✓ fixed in latest |
| CVE-2024-1448 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.57 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.3.57 | 3.3.57 | 2024-02-20 | ✓ fixed in latest |
| CVE-2022-4451 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.45 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.3.45 | 3.3.45 | 2022-12-21 | ✓ fixed in latest |
+ 9 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-4971 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.3.4 | 3.3.4 | 2022-11-29 | ✓ fixed in latest |
| CVE-2021-24746 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.40 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.3.40 | 3.3.40 | 2022-03-15 | ✓ fixed in latest |
| CVE-2021-39321 | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.40 (closed) | Deserialization of Untrusted Data | High 8.8 | < 3.3.40 | 3.3.40 | 2021-10-20 | ✓ fixed in latest |
| — | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4 (closed) | — | Unknown | < 3.3.4 | 3.3.4 | 2019-11-18 | ✓ fixed in latest |
| — | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.76 (closed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.3.76 | 3.3.76 | 0000-00-00 | ✓ fixed in latest |
| — | Social Sharing Plugin – Sassy Social Share [sassy-social-share] < 3.3.4 (closed) | — | Unknown | < 3.3.4 | 3.3.4 | — | ✓ fixed in latest |
| — | Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS) | — | Unknown | < 3.3.4 | 3.3.4 | — | ✓ fixed in latest |
| CVE-2025-5528 | Social Sharing Plugin – Sassy Social Share < 3.3.76 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter | — | Unknown | < 3.3.76 | 3.3.76 | — | ✓ fixed in latest |
| CVE-2026-94170 | Sassy Social Share <= 3.3.79 - Unauthenticated Stored Cross-Site Scripting | — | Unknown | not specified | no fix on file | — | — |
How to fix it
Keep Sassy Social Share updated — 3.3.79 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
1 of the vulnerabilities above has no fixed version on file — there's no update that resolves it. Consider deactivating this plugin or switching to one of the alternatives below.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links — 200000+ active installs — 96/100 (1321) — max PHP 8.4
- ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin — 30000+ active installs — 92/100 (251) — max PHP 8.4
- BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP — 20000+ active installs — 96/100 (85) — max PHP 8.4
- Content Egg – Affiliate Product Importer & Price Comparison — 10000+ active installs — 78/100 (57)
- AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking — 9000+ active installs — 90/100 (35)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.