External Links in New Window / New Tab

External Links in New Window / New Tab has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2022; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.5 out of 10. 2022 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Use Of Web Link To Untrusted Target With Window.Opener Access.

Every one of the 2 issues recorded for External Links in New Window / New Tab has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. External Links in New Window / New Tab is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all External Links in New Window / New Tab vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2022-1583

External Links in New Window / New Tab <= 1.42 - Tabnabbing

Read the full analysis

Vulnerability Records

2 records
External Links in New Window / New Tab banner
Latestv1.45

External Links in New Window / New Tab

WebFactory

Author

WebFactory

4.5(77)
90/100
Last Updated
2026-08-16 (28d ago)
Active Installs
30,000+
Downloads
498,065
Requires WP
4.0+
Requires PHP
5.2+
Tested up to
WP 7.1
Created
2010-09-24 (16y ago)

Opens external links in a new tab or a or new window. You can set URLs that should either be forced to open in a new window or ignored. The plugin produces XHTML Strict compliant code and is search engine optimized (SEO). This is done using JavaScript’s window.open()-function. It adds only a few lines of vanilla JavaScript to the page, and does not require any external libraries like jQuery. Most other plugins perform a hack by altering the target parameter (i.e. <a href="http://somewhere.example" target="_blank">). That method is not XHTML Strict compliant. This plugin handles the links client-side, which lets search engines follow the links properly. Also, if a browser does not support JavaScript, the plugin is simply inactive, and does not result in any errors. If you need a more advanced plugin, with more options try our free WP External Links plugin. Credits Inspired by the Zap_NewWindow plugin by Tom K&ouml;hler. The banner is a photo by Monja Da Riva. Translations Danish by Kristian Risager Larsen Dutch by Paul Staring Lithuanian by Vincent G Other translations will be appreciated! Known bugs The plugin conflicts with other plugins that change the links’ `onClick´ attribute. Original developer Kristian Risager Larsen – kezze.dk

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C