Heateor
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Social Sharing Plugin – Sassy Social Share | 5 | – | Jun 7, 2025 |
| Heateor Social Login WordPress | 2 | – | Nov 6, 2024 |
| Heateor Login – Social Login Plugin | 1 | – | Sep 10, 2025 |
Exploited and recent CVEs
- CVE-2025-9857 Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
- CVE-2025-5528 Social Sharing Plugin – Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter 0.2%
- CVE-2024-11252 Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter 0.9%
- CVE-2024-10020 Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider 0.5%
- CVE-2022-4971 Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting 17.3%
- CVE-2024-32674 Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who 0.3%
- CVE-2024-1989 Social Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.5%
- CVE-2024-1448 Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%