CVEvulnerability

CVE-2022-2600

5.4 MEDIUM Published 2022-08-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-1022

Description

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

Affected configurations

• auto-hyperlink urls project auto-hyperlink urls (<= 5.4.1)

Related

Weakness · CWE (1)

  • CWE-1022 Use of Web Link to Untrusted Target with window.opener Access weakness

References