Logo
Retour à la veille

CVE-2026-95670

Publié : 2 octobre 2026
Modifié : 2 octobre 2026
Lien officiel NVD
Score CVSS
7.2
HIGH

Description détaillée

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/admin/LogTable.php#L95https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/public/Frontend.php#L451https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/public/Frontend.php#L801https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/public/Frontend.php#L989https://plugins.trac.wordpress.org/changeset?reponame=&old=3719796%40mihdan-no-external-links&new=3719796%40mihdan-no-external-linkshttps://www.wordfence.com/threat-intel/vulnerabilities/id/ab5a9850-8990-4e24-9ac3-5b92564c4ad9?source=cve

Dernières Vulnérabilités

CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS

CVE-2026-96292

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS

CVE-2026-96288

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS