Ticket #43280: 43280.2.diff

src/wp-includes/widgets/class-wp-widget-media-image.php

@@ -257 +257 @@
                                 $link .= sprintf( ' rel="%s"', esc_attr( $instance['link_rel'] ) );
                         }
                         if ( ! empty( $instance['link_target_blank'] ) ) {
+                                if ( empty( $instance['link_rel'] ) ) {
+                                        $link .= ' rel="noopener noreferrer"';
+                                }
                                 $link .= ' target="_blank"';
                         }
                         $link .= '>';