CVE-2022-2600

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

Score

CVSS 3.1 5.4 Medium

Status

Modified - contact@wpscan.com

Published

2022-08-22

Last modified

2024-08-03

Weaknesses

CWE-1022

Affected products

• Auto-hyperlink Urls (Auto-hyperlink Urls Project)
• Auto-hyperlink Urls (Unknown)

References

• https://wpscan.com/vulnerability/01bbdefd-bdc3-43ef-9f35-6e7ebe786be2