External Links in New Window / New Tab
External Links in New Window / New Tab has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2022; all 2 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.5 out of 10. 2022 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Use Of Web Link To Untrusted Target With Window.Opener Access.
Every one of the 2 issues recorded for External Links in New Window / New Tab has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. External Links in New Window / New Tab is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-1583External Links in New Window / New Tab <= 1.42 - Tabnabbing
Read the full analysisVulnerability Records

External Links in New Window / New Tab
Author
WebFactory
Opens external links in a new tab or a or new window. You can set URLs that should either be forced to open in a new window or ignored. The plugin produces XHTML Strict compliant code and is search engine optimized (SEO). This is done using JavaScript’s window.open()-function. It adds only a few lines of vanilla JavaScript to the page, and does not require any external libraries like jQuery. Most other plugins perform a hack by altering the target parameter (i.e. <a href="http://somewhere.example" target="_blank">). That method is not XHTML Strict compliant. This plugin handles the links client-side, which lets search engines follow the links properly. Also, if a browser does not support JavaScript, the plugin is simply inactive, and does not result in any errors. If you need a more advanced plugin, with more options try our free WP External Links plugin. Credits Inspired by the Zap_NewWindow plugin by Tom Köhler. The banner is a photo by Monja Da Riva. Translations Danish by Kristian Risager Larsen Dutch by Paul Staring Lithuanian by Vincent G Other translations will be appreciated! Known bugs The plugin conflicts with other plugins that change the links’ `onClick´ attribute. Original developer Kristian Risager Larsen – kezze.dk
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C