CVE-2024-37888: Mlewand Open Link

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code by abusing link href attribute. It affects all users using the Open Link plugin at version < **1.0.5**.

Affected products

• Mlewand Open Link: before 1.0.5 (fixed in 1.0.5)

Published 2024-06-14. Last modified 2026-06-17.