CVE-2021-39321: Heateor Sassy Social Share

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.

Affected products

• Heateor Sassy Social Share: version 3.3.23 only

Published 2021-10-21. Last modified 2026-06-17.