Description
The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.
Published: 2026-08-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The ShareOpenly WordPress plugin has a Cross-Site Scripting flaw that occurs when the $url variable, built from home_url and request arguments, is inserted into an href attribute without escaping. If $url contains special characters or a dangerous URI scheme such as javascript:, the content will be rendered exactly as supplied, allowing arbitrary script execution in the context of any site visitor. This vulnerability can lead to theft of session cookies, defacement, or other typical XSS consequences.

Affected Systems

ShareOpenly WordPress plugin (vendor dartiss) is affected in all releases prior to version 1.2.1. The vulnerability exists in any installation of the plugin that has not been updated to 1.2.1 or newer where the missing esc_url() call remains.

Risk and Exploitability

The CVSS score of 5.3 classifies the flaw as moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves a malicious or compromised filter that injects unsafe values into home_url, or a theme or server configuration that allows special characters in the URL. Once injected, the script runs whenever a user views a post or page that includes the share link, potentially enabling session hijacking or code execution in the visitor's browser.

Generated by OpenCVE AI on August 7, 2026 at 13:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the ShareOpenly plugin to version 1.2.1 or later to apply the missing esc_url() fix.
  • Review and modify any custom filters on home_url, or theme code that may inject unsafe data into URLs, to ensure they do not supply unescaped characters or dangerous schemes.
  • If an immediate upgrade is not feasible, consider temporarily disabling the ShareOpenly sharing link output until the patch can be applied, thereby preventing the XSS vector from appearing in page content.

Generated by OpenCVE AI on August 7, 2026 at 13:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 08 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Dartiss
Dartiss shareopenly
Wordpress
Wordpress wordpress
Vendors & Products Dartiss
Dartiss shareopenly
Wordpress
Wordpress wordpress

Fri, 07 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.
Title ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Dartiss Shareopenly
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T15:10:31.005Z

Reserved: 2026-05-20T18:40:45.834Z

Link: CVE-2026-48094

cve-icon Vulnrichment

Updated: 2026-08-07T15:10:26.419Z

cve-icon NVD

Status : Received

Published: 2026-08-07T13:16:49.493

Modified: 2026-08-07T16:17:25.040

Link: CVE-2026-48094

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T20:41:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')