CVE-2022-2600CWE-1022

Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing

published August 22, 2022

CVSS
—
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00623 · 49.2th percentile
Weakness
CWE-1022 · Use of Web Link to Untrusted Target with window.opener Access
Published
2022-08-22T15:05Z
EPSS history
Timeline
  • 22 AUG 15:05Z
    Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing
    cvelistv5