CVE-2022-2600

CVE-2022-2600: Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing

Vendor Unknown

Product Auto-hyperlink URLs

Weakness CWE-1022

Published August 22, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2600 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1022.html

Related vulnerabilities

04Related CVE

CVE-2022-4927 ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing CVE-2018-25058 Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing CVE-2021-39112 CVE-2024-39727 IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing CVE-2020-36624 ahorner text-helpers translation.rb reverse tabnabbing