The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Put the following payload in any of the text fields in the Settings > Links of the plugin (/wp-admin/admin.php?page=mihdan-no-external-links&tab=links): v < 4.8.0 - "><img src onerror=prompt(/XSS/)> v < 5.0.2 - " style=animation-name:rotation onanimationstart=alert(/XSS/)//
Vaibhav Nitin Gaikwad
Vaibhav Nitin Gaikwad
Yes
2022-06-02 (about 1 years ago)
2022-06-02 (about 1 years ago)
2023-03-03 (about 6 months ago)