Security Alert Summary
The ShareOpenly WordPress plugin contains a cross-site scripting (XSS) vulnerability in versions prior to 1.2.1. The plugin renders a constructed $url value directly into an HTML href attribute without applying WordPress URL escaping. If the $url value is altered by a filter, server configuration, or other change to include HTML-special characters or a dangerous URI scheme, unescaped content can be injected into every singular post or page where the sharing link appears. Version 1.2.1 contains a patch for the issue.
CVE Details
- CVE ID: CVE-2026-48094
- Affected component: ShareOpenly WordPress plugin
- Affected versions: < 1.2.1
- Published: August 7, 2026 1:16:49 PM UTC
- Last modified: August 7, 2026 4:17:25 PM UTC
- CVSS (v4.0): Base score 5.3, MEDIUM
- Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- User Interaction: PASSIVE
- Primary impact: Confidentiality: NONE; Integrity: NONE; Availability: NONE
- Secondary/sub impacts: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Cross-site Scripting)
Technical Details
The plugin constructs a $url value using home_url( add_query_arg( array(), $wp->request ) ) and concatenates that value directly into an HTML href attribute on singular posts and pages. The code does not pass the value through WordPress URL escaping, specifically esc_url(), before rendering. WordPress guidance requires that all URLs placed in HTML output be processed with esc_url() to HTML-encode special characters and to remove dangerous URI schemes such as javascript: and data:. Because the plugin omits this escaping, if the $url value contains HTML-special characters or a dangerous URI scheme as a result of a home_url filter, hosting configuration, or future code change, that unescaped content will be injected verbatim into rendered HTML.
The immediate impact described is cross-site scripting on pages where the share link is displayed. The report indicates that the project patched the issue in version 1.2.1.
How This Could Impact Your Website
In a typical small business WordPress site with multiple users – for example a site owner, internal content editors, and an external contractor or contributor – this vulnerability could allow injected content to appear on public post or page output if the $url value is modified to include unsafe content. An attacker who can cause such unescaped content to be rendered could use it to run scripts in site visitors browsers, which can lead to targeted information exposure or user-focused attacks such as phishing or session abuse depending on the page context.
Practical consequences include the potential exposure of information visible in the page DOM (for example email addresses rendered on a page) and an increased risk of targeted social engineering against staff or contributors. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the ShareOpenly plugin to version 1.2.1 or later as soon as possible, since 1.2.1 contains a patch for this issue.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other accounts with publishing access.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins and themes that might introduce filters affecting URL handling.
- Monitor site activity and public pages for unexpected script injection or unusual behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/dartiss/shareopenly/commit/faf58f0497f3a024ea52c425122ef5aa22e0d7f6
- https://github.com/dartiss/shareopenly/releases/tag/1.2.1
- https://github.com/dartiss/shareopenly/security/advisories/GHSA-v43f-f7jq-7hh5
- https://github.com/dartiss/shareopenly/security/advisories/GHSA-v43f-f7jq-7hh5
