CVE-2021-25033

Medium

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given…

WPScan·CWE-601·Published 2022-02-14

CVSS

6.1

EPSS

0.03

KEV

Exploits

cve.orgen

178 chars

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

NVDen

178 chars

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

El plugin WordPress Newsletter Plugin de WordPress versiones anteriores a 1.6.5, no comprueba el parámetro to antes de redirigir al usuario a su valor dado, conllevando a un problema de redireccionamiento abierto

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:P/I:P/A:N
3.1	Primary	NVD	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N