No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-95670 · Microsoft / collected KEV context

cve-program · CVE-2026-95670

• https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5a9850-8990-4e24-9ac3-5b92564c4ad9?source=cve
• https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/admin/LogTable.php#L95
• https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/public/Frontend.php#L989
• https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/public/Frontend.php#L801
• https://plugins.trac.wordpress.org/browser/mihdan-no-external-links/tags/5.2.0/public/Frontend.php#L451
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3719796%40mihdan-no-external-links&new=3719796%40mihdan-no-external-links

No related operational record is retained in the current change model.