CVE-2026-95670

HighCVSS 7.2/10Last modified Oct 3, 2026

Description

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-956715.3In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the H CVE-2026-956745.3In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules t CVE-2026-956759.8D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attacke CVE-2026-956767.5A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote CVE-2026-956796.9MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains CVE-2026-95685.0A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of t CVE-2026-956808.0IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impers CVE-2026-956824.8MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name settin CVE-2026-956835.3In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched t CVE-2026-956847.2The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Paramete CVE-2026-956855.3MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of s CVE-2026-956867.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St