Redirection Vulnerabilities

The Redirection plugin suffers from a critical Cross-Site Request Forgery vulnerability that allows remote attackers to create a file on the target server and execute arbitrary code. The attack requires an administrator visit a malicious website set up by the attacker, but does not require more interaction nor do they...

CVSS:

8.8

Affected:

up to 3.6.3

Fixed in:

3.6.4

Disclosed:

Nov 14, 2018

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerability appears to have been...

CVSS:

7.2

Affected:

up to 2.7.3

Fixed in:

2.8

Disclosed:

Jul 12, 2018

CVE-2018-1000504 on NVD →

The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.

CVSS:

6.1

Affected:

up to 2.2.9

Fixed in:

2.2.9

Disclosed:

Aug 1, 2014

CVE-2011-5329 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.

CVSS:

5.3

Affected:

up to 2.2.10

Fixed in:

2.2.10

Disclosed:

Aug 1, 2014

CVE-2011-4562 on NVD →

The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.

CVSS:

6.1

Affected:

up to 2.2.12

Fixed in:

2.2.12

Disclosed:

May 4, 2012

CVE-2012-6717 on NVD →