WordPress Plugin Vulnerabilities

Mihdan: No External Links < 5.1.7 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
mihdan-no-external-links
Fixed in 5.1.7

References

CVE
CVE-2025-53451
URL
https://patchstack.com/database/wordpress/plugin/mihdan-no-external-links/vulnerability/wordpress-mihdan-no-external-links-plugin-5-1-4-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bao - BlueRock
Verified
No
WPVDB ID
edbaa6fd-5261-4a8e-9374-f77a96e97646

Timeline

Publicly Published
2025-09-22 (about 8 months ago)
Added
2025-09-26 (about 7 months ago)
Last Updated
2025-10-07 (about 7 months ago)

Other

Published
Title
Published
2026-01-10
Title
Merge + Minify + Refresh < 2.15 - Cross-Site Request Forgery
Published
2025-03-24
Title
Auto Load Next Post <= 1.5.14 - Cross-Site Request Forgery
Published
2025-06-26
Title
VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync
Published
2024-03-19
Title
Contests by Rewards Fuel < 2.0.63 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-06-12
Title
Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import