https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:44:53 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-32221 cnvd-2026-32221 https://cve.radiocsirt.org/vuln/cnvd-2026-32221 https://cve.radiocsirt.org/vuln/euvd-2026-349307 EUVD-2026-349307 https://cve.radiocsirt.org/vuln/euvd-2026-349307 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48094 <p>The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress&#39;s `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp-&gt;request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin&#39;s sharing link is displayed. WordPress&#39;s security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `&#34;`, `&lt;`, `&gt;` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.</p> <p>The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress&#39;s `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp-&gt;request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin&#39;s sharing link is displayed. WordPress&#39;s security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `&#34;`, `&lt;`, `&gt;` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48094