CVE-2024-11252 is a reflected cross-site scripting vulnerability in the Social Sharing Plugin – Sassy Social Share for WordPress, affecting all versions up to and including 3.3.69. The vulnerability is due to improper neutralization of input in the heateor_mastodon_share parameter, which allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they click a crafted link. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session when the victim clicks a maliciously crafted link. This can lead to partial disclosure of confidential information and manipulation of web page content. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the heateor_mastodon_share parameter and consider disabling or limiting use of the affected plugin. Monitor the vendor's communications for updates on patches or official mitigations.