Cross-Site Scripting Vulnerability in ShareOpenly Plugin by Dartiss
CVE-2026-48094

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Shareopenly
Vendor
CVE Published:
7 August 2026

What is CVE-2026-48094?

The ShareOpenly WordPress plugin, prior to version 1.2.1, contains a vulnerability that could allow Cross-Site Scripting attacks due to inadequate URL escaping in HTML content. Specifically, the $url variable used for rendering sharing links is not passed through WordPress's esc_url() function, which is essential for encoding special characters and sanitizing potentially harmful URI schemes. Consequently, unescaped content could be injected into the HTML output, posing a risk if users or other plugins introduce unsafe values. The vulnerability is addressed in version 1.2.1, which implements the necessary security measures to sanitize URLs effectively.

Affected Version(s)

shareopenly < 1.2.1

References

https://github.com/dartiss/shareopenly/security/advisorie...
x_refsource_CONFIRM
https://github.com/dartiss/shareopenly/commit/faf58f0497f...
x_refsource_MISC
https://github.com/dartiss/shareopenly/releases/tag/1.2.1
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.