CVE-2026-95670

Name of the Vulnerable Software and Affected Versions No External Links versions prior to 5.2.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is triggered via the /goto/{base64} redirect endpoint and is only exploitable if the administrator has enabled the Link Encoding: Base64 option in the plugin settings.

Recommendations Update to a version newer than 5.2.0. Disable the Link Encoding: Base64 option in the plugin settings as a temporary mitigation measure.