diff --git src/wp-includes/widgets/class-wp-widget-media-image.php src/wp-includes/widgets/class-wp-widget-media-image.php
index 2b9bff221b..a0359bcbfd 100644
--- src/wp-includes/widgets/class-wp-widget-media-image.php
+++ src/wp-includes/widgets/class-wp-widget-media-image.php
@@ -261,6 +261,9 @@ class WP_Widget_Media_Image extends WP_Widget_Media {
 				$link .= sprintf( ' rel="%s"', esc_attr( $instance['link_rel'] ) );
 			}
 			if ( ! empty( $instance['link_target_blank'] ) ) {
+				if ( empty( $instance['link_rel'] ) ) {
+					$link .= ' rel="noopener noreferrer"';
+				}
 				$link .= ' target="_blank"';
 			}
 			$link .= '>';
diff --git tests/phpunit/tests/widgets/media-image-widget.php tests/phpunit/tests/widgets/media-image-widget.php
index e138f3e796..78d55fc09d 100644
--- tests/phpunit/tests/widgets/media-image-widget.php
+++ tests/phpunit/tests/widgets/media-image-widget.php
@@ -509,6 +509,7 @@ class Test_WP_Widget_Media_Image extends WP_UnitTestCase {
 
 		$this->assertContains( '<a href="https://example.org"', $output );
 		$this->assertContains( 'target="_blank"', $output );
+		$this->assertContains( 'rel="noopener noreferrer"', $output );
 
 		// Populate caption in attachment.
 		wp_update_post(