CVE-2022-2600

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1022

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-260027.2A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-c CVE-2022-260066.7Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of CVE-2022-260077.2An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted CVE-2022-260099.8A stack-based buffer overflow vulnerability exists in the confsrv ucloud_set_node_location functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_0 CVE-2022-26018.6A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_gl CVE-2022-260139.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.as CVE-2022-260178.0Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escala CVE-2022-260198.8Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software CVE-2022-26027.0io_uring UAF, Unix SCM garbage collection CVE-2022-260206.5An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A spe CVE-2022-260227.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may all CVE-2022-260236.5A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted s