CVE-2026-48094

Name of the Vulnerable Software and Affected Versions ShareOpenly versions prior to 1.2.1

Description Cross-Site Scripting occurs due to the missing esc url() escaping function on the $url variable before it is rendered into HTML content. This variable is constructed using home url( add query arg( array(), $wp->request ) ) and is concatenated directly into an HTML href attribute on singular posts or pages. The absence of this function allows unescaped content to be injected into the rendered HTML if the $url value contains HTML-special characters or dangerous URI schemes, such as javascript: or data:, which could be introduced via a home url WordPress filter, specific server configurations, or code changes.

Recommendations Update to version 1.2.1.