Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
451 results · page 4 of 10
Mar 1, 2025IP2Location Redirection: Unauthorized access of dataCVE-2025-1502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.
- Product
- IP2Location Redirection
- Affected
- up to 1.33.3
- What to do
- Affects up to 1.33.3. Update IP2Location Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2025Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection.CVE-2025-26058 · Other software · Webkul · reported by MITREMedium 4.2
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
- Product
- Qloapps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing.CVE-2025-1269 · Other software · HAVELSAN · reported by iletisim@usom.gov.trMedium 4.8
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1 - 1010.
- Product
- Liman MYS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsiberguvenlik.gov.tr
Jan 27, 2025KB Support: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24741 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7.
- Product
- KB Support
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LearnPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24740 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1.
- Product
- LearnPress
- Affected
- up to 4.2.7.1
- What to do
- Affects up to 4.2.7.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025SEO Blogger to WordPress Migration using 301 Redirection: Reflected Cross-Site ScriptingCVE-2024-13422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SEO Blogger to WordPress Migration using 301 Redirection
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update SEO Blogger to WordPress Migration using 301 Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2025REDIRECTION PLUS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23681 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.
- Product
- REDIRECTION PLUS
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update REDIRECTION PLUS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items.CVE-2024-55452 · Other software · Ujcms · reported by MITREMedium 5.4
A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
- Product
- Ujcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Redirection for Contact Form 7: Missing AuthorizationCVE-2023-39920 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.
- Product
- Redirection for Contact Form 7
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2024Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2024-54051 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.CVE-2024-54050 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
- Product
- Adobe Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Login Widget With Shortcode: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-54255 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.
- Product
- Login Widget With Shortcode
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Login Widget With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2024Simple Redirection: Cross-Site Request ForgeryCVE-2024-11341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Simple Redirection
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 15, 2024An open redirection vulnerability exists in pyload/pyload version 0.5.0.CVE-2024-1240 · Other software · pyload · reported by security@huntr.devMedium 6.1
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows fCVE-2024-46872 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.6
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024Sunshine Photo Cart: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-50463 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024Simple Membership: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-49682 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple Membership: from n/a through <= 4.5.3.
- Product
- Simple Membership
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024ElementsReady Addons for Elementor: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47353 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects ElementsReady Addons for Elementor: from n/a through 6.4.2.
- Product
- ElementsReady Addons for Elementor
- Affected
- up to 6.4.2
- What to do
- Affects up to 6.4.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024EventPrime: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
- Product
- EventPrime
- Affected
- up to 4.0.4.5
- What to do
- Affects up to 4.0.4.5. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024Simple Membership After Login Redirection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47354 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through <= 1.6.
- Product
- Simple Membership After Login Redirection
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Simple Membership After Login Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2024The web server of affected devices does not properly validate input that is used for a user redirection.CVE-2024-46886 · Other software · Siemens · reported by productcert@siemens.comMedium 5.1
The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted link.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Oct 6, 2024Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-45247 · Other software · Sonarr · reported by cna@cyber.gov.ilMedium 6.1
Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- Product
- Sonarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2024Payflex Payment Gateway: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47646 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payment Gateway: from n/a through <= 2.6.1.
- Product
- Payflex Payment Gateway
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProviderCVE-2024-43683 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5High 8.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.
- Product
- TimeProvider 4100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgruppotim.itmicrochip.com
Oct 3, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express.CVE-2024-9266 · Other software · expressjs · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
- Product
- express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.CVE-2024-7312 · Other software · Payara Platform · reported by 769c9ae7-73c3-4e47-ae19-903170fc3eb8High 7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.
- Product
- Payara Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.payara.fishdocs.payara.fish
Sep 11, 2024In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed.CVE-2024-8646 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.1
In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').
- Product
- Eclipse Glassfish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Sep 8, 2024Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-42341 · Other software · Loway · reported by cna@cyber.gov.ilMedium 6.1
Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- Product
- QueueMetrics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects NetwCVE-2024-7428 · Other software · OpenText™ · reported by security@opentext.comMedium 4.8
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2.
- Product
- Network Node Manager i (NNMi)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection CVE-2024-40886 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.6
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCCVE-2024-6377 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.1
An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.
- Product
- 3DSwymer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2024Salon booking system: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43280 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1.
- Product
- Salon booking system
- Affected
- up to 10.8.1
- What to do
- Affects up to 10.8.1. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Easy PayPal Buy Now Button: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43236 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
- Product
- Easy PayPal Buy Now Button
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Easy PayPal Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024All In One Redirection: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37245 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Reflected XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
- Product
- All In One Redirection
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update All In One Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2024Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5CVE-2024-6149 · Network & remote access · Citrix · reported by secure@citrix.comMedium 4.8
Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5
- Product
- Citrix Workspace app for HTML5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jul 6, 2024Academy LMS: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-37234 · WordPress plugins & themes · reported by PatchstackLow 3.5
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
- Product
- Academy LMS
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 26, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields.CVE-2024-4604 · Other software · Magarsus Consultancy · reported by iletisim@usom.gov.trMedium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields. This issue affects SSO (Single Sign On): from 1.0 before 1.1.
- Product
- SSO (Single Sign On)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jun 19, 2024SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs.CVE-2024-37881 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Jun 3, 2024A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow aCVE-2024-23664 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.1
A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.
- Product
- FortiAuthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comfortiguard.fortinet.com
May 17, 2024Redirection for Contact Form 7: Improper Privilege ManagementCVE-2023-23990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Privilege Management vulnerability in Qube One Ltd. Redirection for Contact Form 7 wpcf7-redirect allows Privilege Escalation.This issue affects Redirection for Contact Form 7: from n/a through 2.7.0.
- Product
- Redirection for Contact Form 7
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2024Share This Image: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-33930 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ILLID Share This Image.This issue affects Share This Image: from n/a through 1.97.
- Product
- Share This Image
- Affected
- up to 1.97
- What to do
- Affects up to 1.97. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Video Conferencing with Zoom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-33584 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with Zoom: from n/a through 4.4.4.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024FV Flowplayer Video Player: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-32078 · WordPress plugins & themes · reported by PatchstackMedium 4.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.44.7212
- What to do
- Affects up to 7.5.44.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 18, 2024The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability.CVE-2024-28076 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7
The SolarWinds Platform was susceptible to a Arbitrary Open Redirection Vulnerability. A potential attacker can redirect to different domain when using URL parameter with relative entry in the correct format
- Product
- SolarWinds Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Apr 15, 2024Freshdesk (official): URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-32129 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Freshworks Freshdesk (official).This issue affects Freshdesk (official): from n/a through 2.3.6.
- Product
- Freshdesk (official)
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Freshdesk (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024App Builder: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31282 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7.
- Product
- App Builder
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024OAuth Server: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31253 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3.
- Product
- OAuth Server
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 2, 2024A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.CVE-2024-28287 · Other software · gbgplc · reported by MITREHigh 7.3
A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.
- Product
- instinct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024All In One Redirection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
- Product
- All In One Redirection
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update All In One Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2024Uncanny Toolkit for LearnDash: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-34020 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.6.4.3
- What to do
- Affects up to 3.6.4.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.