CVE-2026-48094: ShareOpenly WordPress Plugin XSS Flaw

CVE-2026-48094 Overview

CVE-2026-48094 is a Cross-Site Scripting (XSS) vulnerability in the ShareOpenly WordPress plugin prior to version 1.2.1. The plugin fails to apply WordPress's esc_url() escaping function to the $url variable before rendering it into an HTML href attribute. The unescaped $url is derived from home_url( add_query_arg( array(), $wp->request ) ) and is emitted on every singular post or page where the sharing link appears. If the value contains HTML-special characters or a dangerous URI scheme such as javascript: or data:, the content is injected verbatim into the page markup. Version 1.2.1 contains the fix. This issue is tracked under [CWE-79].

Critical Impact
An attacker who can influence the home_url filter output, through another plugin, theme, or hosting configuration, can inject arbitrary script into every singular post or page rendered by the site.

Affected Products

ShareOpenly WordPress plugin versions prior to 1.2.1
WordPress sites rendering the ShareOpenly sharing link on singular posts or pages
Sites where other plugins or themes filter home_url output

Discovery Timeline

2026-08-07 - CVE-2026-48094 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-48094

Vulnerability Analysis

The vulnerability resides in inc/add-sharing-link.php, where the plugin concatenates the $url variable directly into an anchor tag's href attribute. WordPress's security handbook mandates that every URL placed in HTML output pass through esc_url(). That function HTML-encodes special characters such as ", <, and >, and strips dangerous URI schemes including javascript: and data:.

Because the plugin omits this escaping, any HTML-special character or hostile scheme present in $url reaches the browser unmodified. The sharing link is emitted on every singular post or page, so a successful injection triggers on all content views that render the widget. Exploitation requires user interaction with a crafted page and depends on external influence over the URL value.

Root Cause

The $url variable is built from home_url( add_query_arg( array(), $wp->request ) ) and then concatenated into an HTML attribute without sanitization. WordPress's home_url value can be modified by any plugin or theme that hooks the home_url filter, and web server or hosting configurations can also influence the request path. When those inputs contain unexpected characters, the plugin propagates them into the DOM.

Attack Vector

An attacker needs a mechanism to influence the home_url output or the $wp->request value on the target site. Once a payload reaches $url, every visitor loading a singular post or page executes the injected content in the site's origin. The attack is network-based and requires user interaction with the affected page.

php

// Vulnerable code (pre-1.2.1) vs patched code (1.2.1)
global $wp;
$url = home_url( add_query_arg( array(), $wp->request ) );

// Vulnerable: $url concatenated directly into href attribute
$content .= '<div class="shareopenly"><img src="' . esc_url( plugins_url( '../images/logo.svg', __FILE__ ) ) . '" alt="" referrerpolicy="no-referrer"> <a href="https://shareopenly.org/share/?url=' . $url . '&text=' . $title . '" loading="lazy" decoding="async" aria-hidden="true" />' . esc_html( $settings['text'] ) . '</a></div>';

// Patched: entire href value wrapped in esc_url()
$content .= '<div class="shareopenly"><img src="' . esc_url( plugins_url( '../images/logo.svg', __FILE__ ) ) . '" alt="" referrerpolicy="no-referrer"> <a href="' . esc_url( 'https://shareopenly.org/share/?url=' . $url . '&text=' . $title ) . '" loading="lazy" decoding="async" aria-hidden="true" />' . esc_html( $settings['text'] ) . '</a></div>';

Source: GitHub Commit faf58f0

Detection Methods for CVE-2026-48094

Indicators of Compromise

Rendered pages containing a <div class="shareopenly"> element with an unexpected href value that breaks out of the attribute using ", >, or a javascript: scheme.
Web server access logs showing requests to singular posts or pages with crafted query strings that survive into $wp->request.
Installed ShareOpenly plugin version metadata below 1.2.1 in wp-content/plugins/shareopenly/.

Detection Strategies

Inspect the plugin directory for versions prior to 1.2.1 and audit installed plugins or themes that hook the home_url filter.
Fetch representative singular URLs and grep responses for shareopenly markup containing unescaped quotes or angle brackets inside the href.
Review DOM-based XSS scanner output against public site pages that display the sharing link.

Monitoring Recommendations

Alert on WordPress plugin file changes and on installation of new plugins that register home_url filters.
Monitor edge or WAF logs for requests carrying %22, %3C, or javascript%3A in the request path targeting singular content.
Track outbound requests from browsers to unexpected domains originating from post pages, which can indicate script injection.

How to Mitigate CVE-2026-48094

Immediate Actions Required

Upgrade the ShareOpenly plugin to version 1.2.1 or later on every WordPress site where it is installed.
Audit any custom or third-party code that filters home_url and confirm the returned value is a well-formed URL.
Verify that reverse proxy and hosting configurations do not inject unsanitized characters into $wp->request.

Patch Information

The fix is available in ShareOpenly 1.2.1. The change wraps the full anchor URL with esc_url() in inc/add-sharing-link.php and switches settings form attributes from esc_html() to esc_attr() in inc/settings.php. See the GHSA-v43f-f7jq-7hh5 advisory for the full patch record.

Workarounds

Temporarily disable the ShareOpenly plugin until the site is updated to 1.2.1.
Restrict which post types display the sharing link in the plugin settings to reduce the affected surface.
Deploy a Content Security Policy that disallows inline scripts and javascript: URIs to blunt XSS payloads.

bash

# Update the plugin from WP-CLI
wp plugin update shareopenly --version=1.2.1

# Or disable the plugin until the update can be applied
wp plugin deactivate shareopenly