ShareOpenly CVE-2026-48094

Exploitation requires ShareOpenly prior to 1.2.1 to be active AND the $url variable - derived from home_url( add_query_arg( array(), $wp->request ) ) - to contain HTML-special characters or a dangerous URI scheme at page render time. This tainted value can arise in three scenarios documented in the CVE: (1) a co-installed plugin or active theme applies a home_url WordPress filter that modifies the base URL to include such characters; (2) a web server or hosting configuration injects unexpected content into the request path; or (3) future code changes alter URL construction. On a default WordPress installation with no home_url filter applied, $url resolves to a clean absolute URL and the vulnerability is NOT exploitable. User interaction is required per CVSS UI:P - a site visitor must load an affected singular post or page for the unescaped href to render in their browser.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) reflects a network-accessible, low-complexity flaw requiring only passive user interaction - a visitor loading any affected post or page. Subsequent-system impact metrics SC:L/SI:L confirm the risk is limited to the visitor's browser, not the WordPress server itself. No EPSS data, no CISA KEV listing, and no public exploit code are present in the available intelligence. Real-world exploitability is meaningfully constrained by a precondition: the $url value must be tainted by a home_url WordPress filter applied by a co-installed plugin or theme, a specific server or hosting configuration, or a code-level change - none of which apply on a default WordPress installation. This precondition limits practical exposure relative to the raw network-accessible CVSS framing, making this a medium-priority patch rather than an emergency. The vulnerability is rendered on every post and page (not just admin surfaces), so the audience at risk is all site visitors if conditions are met, not just privileged users.

An attacker identifies a WordPress site running ShareOpenly prior to 1.2.1 alongside another plugin that applies a home_url filter, causing the $url variable to include a javascript: URI or HTML-special characters. When any visitor loads a singular post or page on that site, the ShareOpenly sharing widget renders the unescaped href attribute verbatim in the browser, executing attacker-controlled JavaScript and enabling session cookie theft or authenticated actions on behalf of the victim. No public exploit code has been identified at time of analysis.