No External Links
Monthly
Stored cross-site scripting in the No External Links WordPress plugin (all versions up to and including 5.2.0) lets an unauthenticated remote attacker inject arbitrary web scripts through the Log URL handling of the /goto/{base64} redirect path, with the injected payload executing when a privileged user views the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2 HIGH), and per the independent assessment the attack is network-reachable and unauthenticated but is gated by a non-default prerequisite: the administrator must have enabled the 'Link Encoding: Base64' option, and the payload only fires once a victim later loads the poisoned page, such as an admin reviewing the plugin's log table. Sites running 5.2.0 or earlier without Base64 link encoding enabled are not affected, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in the No External Links WordPress plugin (all versions up to and including 5.2.0) lets an unauthenticated remote attacker inject arbitrary web scripts through the Log URL handling of the /goto/{base64} redirect path, with the injected payload executing when a privileged user views the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2 HIGH), and per the independent assessment the attack is network-reachable and unauthenticated but is gated by a non-default prerequisite: the administrator must have enabled the 'Link Encoding: Base64' option, and the payload only fires once a victim later loads the poisoned page, such as an admin reviewing the plugin's log table. Sites running 5.2.0 or earlier without Base64 link encoding enabled are not affected, and no public exploit code was identified at time of analysis.