Known vulnerabilities in External Links – nofollow, noopener & new window

Internal links & external links manager: open in new window or tab, control nofollow, ugc, sponsored & noopener. SEO friendly.

2Reported vulnerabilities

6.4Highest CVSS score

2.66Latest version

90,000+Active installs

What to do now

Update External Links – nofollow, noopener & new window to 2.56 or later. 2 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 16, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-3621801a-231b-4678-bfb5-fbf18e58a658	Medium 6.4	—	Before 1.81	`1.81`	March 23, 2016
WF-1254e0ad-852e-4fd4-8317-61bfbbc9f737	Medium 5.5	—	2.55 and earlier	`2.56`	November 20, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.