Skip to content
Sign in
Not rated

CVE-2021-24838 The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to…

Description

The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.

Affected products and versions

Product Affected versions Fixed in
AnyComment 0.3 earliest → < 0.3.5 0.3.5

Other CVEs of AnyComment

The 3 CVEs of AnyComment →
CVE-2022-0279 The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply,… Not rated CVE-2022-0134 The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features,… Not rated
Track this CVE