Input validation vulnerability in External Links – nofollow, noopener & new window 2.55

The External Links plugin for WordPress is vulnerable to a type of cyber attack in versions up to and including 2.55. This type of attack, known as Stored Cross-Site Scripting, puts users at risk of having malicious scripts execute on their computers when they visit certain webpages. To be vulnerable to this attack, a WordPress installation must be a multi-site installation, or have a security setting called “unfiltered_html” disabled. Administrators with elevated privileges are able to inject these malicious scripts into webpages.