Lucene search
HistoryAug 22, 2022 - 3:15 p.m.
CVE-2022-2600
wordpress
plugin
vulnerability
tab nabbing
window.opener
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
0.001
Percentile
40.2%
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel=“noopener noreferer” on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.
Affected configurations
Node
auto-hyperlink_urls_projectauto-hyperlink_urlsRange≤5.4.1wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| auto-hyperlink_urls_project | auto-hyperlink_urls | * | cpe:2.3:a:auto-hyperlink_urls_project:auto-hyperlink_urls:*:*:*:*:*:wordpress:*:* |
Related
cvelist
cvelist
CVE-2022-2600 Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing
2022-08-22 15:05:12
patchstack
patchstack
WordPress Auto-hyperlink URLs plugin <= 5.4.1 - Tab Nabbing vulnerability
2022-08-01 00:00:00
cve
cve
CVE-2022-2600
2022-08-22 15:15:15
prion
prion
Code injection
2022-08-22 15:15:00
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
0.001
Percentile
40.2%
Related for NVD:CVE-2022-2600