CVE-2026-48094 describes a Cross-Site Scripting vulnerability in the ShareOpenly WordPress plugin by dartiss. The vulnerability arises from the plugin's failure to apply the esc_url() escaping function on the $url variable before embedding it in an HTML href attribute. This $url is built from home_url(add_query_arg(array(), $wp->request)) and is used on every singular post or page where the sharing link appears. Without esc_url(), special HTML characters and dangerous URI schemes like javascript: or data: are not sanitized, potentially allowing injection of malicious scripts if the URL is manipulated via WordPress filters, server configurations, or future code changes. The issue is fixed in version 1.2.1.

If exploited, this vulnerability could allow an attacker to inject malicious scripts into the HTML output of posts or pages, potentially leading to Cross-Site Scripting attacks. This could affect site visitors by executing unauthorized scripts in their browsers. However, exploitation requires the $url variable to contain unsafe content, which depends on other plugins, themes, or configurations altering the home_url output. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and user interaction needed.

Version 1.2.1 of the ShareOpenly plugin contains a patch that applies the esc_url() function to the $url variable, mitigating the vulnerability. Users should upgrade to version 1.2.1 or later to resolve this issue. No additional mitigations are indicated by the vendor advisory. Patch status is not explicitly confirmed beyond the mention of version 1.2.1 containing the fix, so users should verify the update from the vendor.