plugin

Premmerce Redirect Manager Vulnerabilities

5 known security issues reported for the Premmerce Redirect Manager WordPress plugin. Most recent disclosed Mar 20, 2026.

5 medium

Running Premmerce Redirect Manager on your site? Check whether your installed version is affected.

Scan your site free

Premmerce Redirect Manager <= 1.0.12 - Missing Authorization

medium

The Premmerce Redirect Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:
4.3
Affected:
up to 1.0.12
Fixed in:
1.0.13
Disclosed:
Mar 20, 2026

CVE-2026-32541 on NVD →

Premmerce Redirect Manager <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting

medium

The Premmerce Redirect Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 1.0.12 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

CVSS:
4.4
Affected:
up to 1.0.12
Fixed in:
1.0.12
Disclosed:
Nov 13, 2023

Premmerce Redirect Manager <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

medium

The Premmerce Redirect Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject...

CVSS:
4.4
Affected:
up to 1.0.9
Fixed in:
1.0.12
Disclosed:
Mar 30, 2023

CVE-2023-23789 on NVD →

Premmerce Redirect Manager <= 1.0.10 - Cross-Site Request Forgery via deleteRedirect()

medium

The Premmerce Redirect Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.10. This is due to missing or incorrect nonce validation on the deleteRedirect() function called via an admin_post hook. This makes it possible for unauthenticated attackers to delete re...

CVSS:
4.3
Affected:
up to 1.0.10
Fixed in:
1.0.11
Disclosed:
Mar 30, 2023

CVE-2023-23787 on NVD →

Freemius SDK <= 2.4.2 - Missing Authorization Checks

medium

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:
6.3
Affected:
up to 1.0.7
Fixed in:
1.0.7
Disclosed:
Mar 4, 2022

CVE-2022-4974 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database