Shareopenly
Monthly
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.