CVE-2021-24838
Assigner: WPScan
Published: 2022-01-17T13:00:27
State: PUBLISHED
affected: product: AnyComment
vendor: Unknown
versions: lessThan: 0.3.5
status: affected
version: 0.3.5
versionType: custom
credits: value: Brandon Roldan
descriptions: value: The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
problemTypes: descriptions: cweId: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
type: CWE
source: discovery: EXTERNAL
title: AnyComment < 0.3.5 - Open Redirect
x_generator: WPScan CVE Generator