Mihdan: No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Redirect Logs
- ID
- WPSEC-2026-0109
- Plugin
- No External Links (mihdan-no-external-links)
- Affected
- all versions before 5.3.0
- Remediation
- Update to 5.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Mihdan: No External Links on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-95670, on 2026-10-01.
Description
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirect logs in all versions up to, and including, 5.2.0 due to insufficient validation of the Base64-decoded /goto/ redirect target before it is written to the click log, and missing output escaping of the logged URL in the admin Logs screen. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the Logs page. Exploitation requires the site to use the non-default Base64 link encoding with click logging enabled (logging is on by default).
References
- https://wpsec.com/vuln/WPSEC-2026-0109/
- https://plugins.svn.wordpress.org/mihdan-no-external-links/tags/5.3.0/
- https://wordpress.org/plugins/mihdan-no-external-links/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS