Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbKrzysztof ZającWPVDB-ID:AF548FAB-96C2-4129-B609-E24AAD0B1FC4
HistoryMar 29, 2022 - 12:00 a.m.

English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect

2022-03-2900:00:00
Krzysztof Zając
wpscan.com
15
wordpress
admin
unauthenticated
open redirect
plugin
validation
language
issue
security

EPSS

0.001

Percentile

43.5%

JSON

The plugin does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue

PoC

https://example.com/wp-admin/admin-ajax.php?action=heartbeat&amp;admin;_custom_language_toggle=1&amp;admin;_custom_language_return_url=https://wpscan.com

Related

nuclei 1
nvd 1
wpexploit 1
patchstack 1
cvelist 1
prion 1
cve 1
nuclei
nuclei
WordPress English Admin <1.5.2 - Open Redirect
2022-04-29 20:19:48
nvd
nvd
CVE-2021-25111
2022-04-25 16:16:07
wpexploit
wpexploit
English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect
2022-03-29 00:00:00
patchstack
patchstack
WordPress English WordPress Admin plugin <= 1.5.1 - Unauthenticated Open Redirect vulnerability
2022-03-29 00:00:00
cvelist
cvelist
CVE-2021-25111 English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect
2022-04-25 15:50:47
prion
prion
Open redirect
2022-04-25 16:16:00
cve
cve
CVE-2021-25111
2022-04-25 16:16:07

EPSS

0.001

Percentile

43.5%

JSON
Related for WPVDB-ID:AF548FAB-96C2-4129-B609-E24AAD0B1FC4
nuclei1nvd1wpexploit1patchstack1cvelist1prion1cve1