CVE-2021-25033
published 2022-02-14CVE-2021-25033: The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an…
PriorityP337medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
2.68%
83.9th percentile
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| noptin | noptin | < 1.6.5 | 1.6.5 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Noptin < 1.6.5 - Open Redirect
nuclei·CVSS 6.1
CVE-2021-25033 [MEDIUM] Noptin < 1.6.5 - Open Redirect
Noptin < 1.6.5 - Open Redirect
Noptin < 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue.
Template:
id: CVE-2021-25033
info:
name: Noptin < 1.6.5 - Open Redirect
author: dhiyaneshDk
severity: medium
description: Noptin < 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue.
impact: |
An attacker can trick users into visiting malicious websites, leading to phishing attacks.
remediation: |
Update to Noptin plugin version 1.6.5 or later.
reference:
- https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c
- ht
2022-02-14
Published