Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: mihdan Clear all filters
TI-2026-65972 CVE-2026-95670 · GHSA-wwjw-5544-v47j

No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

Priority LOW 31

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and outpu…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00241 Published 2026-10-02 No fix listed CWE-79
TI-2025-07879 CVE-2025-8608 · GHSA-g9m7-7gm5-h3fp

Mihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins

Priority LOW 28

The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 1.6.11 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-09-30 No fix listed CWE-79
TI-2025-33397 CVE-2025-53451 · GHSA-gvgg-7x9j-w5p5

WordPress Mihdan: No External Links Plugin <= 5.1.6.2 - Cross Site Request Forgery (CSRF) Vulnerability

Priority LOW 24

Cross-Site Request Forgery (CSRF) vulnerability in mihdan Mihdan: No External Links mihdan-no-external-links allows Cross Site Request Forgery.This issue affects Mihdan: No External Links: from n/a through <= 5.1.6.2.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00169 Published 2025-09-22 No fix listed CWE-352
TI-2024-04106 CVE-2024-4411 · GHSA-7qgp-w8r9-jfr6

Mihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The Mihdan: Yandex Turbo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.6.5.1 due to insufficient input sanitization and outpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00353 Published 2024-05-09 No fix listed CWE-79
TI-2022-00990 CVE-2022-1095 · GHSA-r9cv-53c9-hgr9

Mihdan: No External Links < 5.0.2 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00588 Published 2022-06-27 Fixed in 5.0.2 CWE-79