CVE-2025-5528 is a reflected cross-site scripting vulnerability in the Social Sharing Plugin – Sassy Social Share for WordPress. The issue occurs due to improper neutralization of input in the heateor_mastodon_share parameter, enabling attackers to inject malicious scripts that execute in the context of a user's browser when they click a crafted link. This affects all versions up to and including 3.3.75. The vulnerability is unauthenticated and has a medium severity rating with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No patch or official fix has been documented in the provided data.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts such as theft of user session data or manipulation of webpage content. There is no impact on availability. The vulnerability requires user interaction (clicking a crafted link) and affects the confidentiality and integrity of user data within the affected WordPress plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or implementing web application firewall (WAF) rules to block malicious payloads targeting the heateor_mastodon_share parameter. Avoid clicking on suspicious links that could exploit this vulnerability.