No External Links (<= 5.2.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/no-external-links--5.2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 02 Oct 2026 08:23:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS Vulnerability in No External Links WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-no-external-links-xss/Fri, 02 Oct 2026 08:23:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-no-external-links-xss/The No External Links WordPress plugin (<= 5.2.0) is vulnerable to Stored Cross-Site Scripting (XSS) via the /goto/ redirect feature, allowing unauthenticated attackers to inject malicious scripts.The 'No External Links' plugin for WordPress, in all versions up to and including 5.2.0, contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from insufficient input sanitization and output escaping within the plugin's URL logging functionality. Specifically, the vulnerability resides in the /goto/ redirect mechanism when the 'Link Encoding: Base64' setting is enabled by an administrator. An unauthenticated attacker can craft a malicious URL containing a Base64-encoded JavaScript payload and trigger the storage of this script within the site's logs. When a user - such as an administrator - subsequently views the affected page or logs, the injected script executes in the context of the victim's browser. This could lead to session hijacking, unauthorized actions on behalf of the user, or further site compromise.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. Depending on the privileges of the victim viewing the logs, this could result in account takeover, defacement, or the injection of additional malicious content into the WordPress site. Given the plugin's function to manage external links, this vulnerability poses a significant risk to site integrity and user data privacy.

Recommendation

  • Upgrade the 'No External Links' plugin to the latest version (patch version > 5.2.0) immediately.
  • Disable the 'Link Encoding: Base64' feature within the plugin settings until a patch is applied if immediate upgrading is not feasible.
  • Monitor webserver access logs for anomalous requests to the '/goto/' directory containing Base64 strings.
  • Implement a strong Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the execution of inline scripts.
]]>highadvisorywordpressxssweb-applicationvulnerability