Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
In short
The Auto-hyperlink URLs plugin fails to protect links it creates, allowing websites you click on to take control of your browser tab and redirect you to a phishing site. This happens because the plugin doesn't add security attributes that prevent this hijacking.
Technical detail
The plugin generates external links without setting rel="noopener noreferrer" attributes, allowing target websites to access the source window object via window.opener and perform tab nabbing attacks. An attacker can redirect the original tab to a phishing page while the user is viewing the opened site, requiring no user interaction beyond the initial click.
Summary generated and translated by AI from the official description.
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.
Affected products
Unknown · Auto-hyperlink URLs