Auto-hyperlink URLs WordPress Plugin Tab Nabbing Vulnerability

CVE-2022-2600 · MEDIUM Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

Learn more about our Wordpress Pen Testing.