blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-25033

MEDIUM 6.1 CVSS 3.1
Published
February 14, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-601
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

Affected products and versions

  • Unknown WordPress Newsletter Plugin – Noptin — From 1.6.5 (including) to 1.6.5 (excluding)
  • noptin noptin — Before 1.6.5

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2639592 Patch, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record