CVE-2026-48094 describes a Cross-Site Scripting vulnerability in the ShareOpenly WordPress plugin by dartiss. The vulnerability arises because the plugin fails to apply WordPress's esc_url() escaping function to the $url variable, which is constructed from home_url(add_query_arg(array(), $wp->request)) and inserted directly into an HTML href attribute. Without esc_url(), special HTML characters and dangerous URI schemes like javascript: or data: are not neutralized, allowing potential injection of malicious content. This affects every singular post or page where the sharing link is displayed. The vulnerability is addressed in ShareOpenly version 1.2.1.

An attacker could exploit this vulnerability to inject malicious scripts into the HTML output of posts or pages, potentially leading to Cross-Site Scripting attacks. This could affect site visitors by executing arbitrary scripts in their browsers. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low complexity, no privileges required, and user interaction needed.

The vulnerability is fixed in ShareOpenly version 1.2.1. Users should upgrade to version 1.2.1 or later to remediate this issue. No additional mitigation is required if the plugin is updated.