CWE-601— URL Redirection to Untrusted Site (Open Redirect)

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.— MITRE CWE catalog

1,776 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-601page 31 of 36

CVE-2025-53821MEDIUMCVSS 4.7EG 4.7
2025-07-14
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arb…
CVE-2025-49868MEDIUMCVSS 4.7EG 4.7
2025-06-17
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.
CVE-2025-49325MEDIUMCVSS 4.7EG 4.7
2025-06-06
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0.
CVE-2025-30954MEDIUMCVSS 4.7EG 4.7
2025-06-06
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.…
CVE-2025-30953MEDIUMCVSS 4.7EG 4.7
2025-06-06
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
CVE-2025-5183MEDIUMCVSS 4.7EG 4.7
2025-05-26
A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument Hos…
CVE-2025-47644MEDIUMCVSS 4.7EG 4.7
2025-05-07
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM wi…
CVE-2025-47456MEDIUMCVSS 4.7EG 4.7
2025-05-07
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
CVE-2025-47455MEDIUMCVSS 4.7EG 4.7
2025-05-07
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n…
CVE-2025-47454MEDIUMCVSS 4.7EG 4.7
2025-05-07
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
CVE-2025-39404MEDIUMCVSS 4.7EG 4.7
2025-04-24
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects Sassy Social Share: from n/a through <= 3.3.73.
CVE-2025-39599MEDIUMCVSS 4.7EG 4.7
2025-04-16
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.
CVE-2025-39597MEDIUMCVSS 4.7EG 4.7
2025-04-16
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Arthur Yarwood Fast eBay Listings fast-ebay-listings allows Phishing.This issue affects Fast eBay Listings: from n/a through <= 2.12.15.
CVE-2025-32694MEDIUMCVSS 4.7EG 4.7
2025-04-09
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate WP Mail: from n/a through <= 1.3.10.
CVE-2025-32693MEDIUMCVSS 4.7EG 4.7
2025-04-09
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Phishing.This issue affects WebinarPress: from n/a through <= 1.33.28.
CVE-2025-31871MEDIUMCVSS 4.7EG 4.7
2025-04-01
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue affects WP Clone any post type: from n/a through <= 3.6.
CVE-2025-31821MEDIUMCVSS 4.7EG 4.7
2025-04-01
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.
CVE-2025-30885MEDIUMCVSS 4.7EG 4.7
2025-03-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through <= 2.18.0.
CVE-2025-30884MEDIUMCVSS 4.7EG 4.7
2025-03-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrations: from n/a through <= 2.4.10.
CVE-2025-30859MEDIUMCVSS 4.7EG 4.7
2025-03-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a through <= 3.5.1.
CVE-2025-30795MEDIUMCVSS 4.7EG 4.7
2025-03-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.5.1.
CVE-2025-30781MEDIUMCVSS 4.7EG 4.7
2025-03-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order …
CVE-2025-28896MEDIUMCVSS 4.7EG 4.7
2025-03-11
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through <= 1.0.0.
CVE-2025-1488MEDIUMCVSS 4.7EG 4.7
2025-02-24
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. Thi…
CVE-2025-24741MEDIUMCVSS 4.7EG 4.7
2025-01-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7.
CVE-2025-24740MEDIUMCVSS 4.7EG 4.7
2025-01-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1.
CVE-2024-54255MEDIUMCVSS 4.7EG 4.7
2024-12-09
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.
CVE-2022-20634MEDIUMCVSS 4.7EG 4.7
2024-11-15
A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL paramet…
CVE-2024-50463MEDIUMCVSS 4.7EG 4.7
2024-10-28
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
CVE-2024-49682MEDIUMCVSS 4.7EG 4.7
2024-10-24
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple Membership: from n/a through <= 4.5.3.
CVE-2024-47353MEDIUMCVSS 4.7EG 4.7
2024-10-11
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects ElementsReady Addons for Elementor: from n/a through 6.4.2.
CVE-2024-47648MEDIUMCVSS 4.7EG 4.7
2024-10-10
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
CVE-2024-47354MEDIUMCVSS 4.7EG 4.7
2024-10-10
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a thro…
CVE-2024-46886MEDIUMCVSS 4.7EG 4.7
2024-10-08
The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the …
CVE-2024-47646MEDIUMCVSS 4.7EG 4.7
2024-10-05
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payment Gateway: from n/a through <= 2.6.1.
CVE-2024-9266MEDIUMCVSS 4.7EG 4.7
2024-10-03
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
CVE-2024-43280MEDIUMCVSS 4.7EG 4.7
2024-08-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1.
CVE-2024-43236MEDIUMCVSS 4.7EG 4.7
2024-08-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
CVE-2024-7211MEDIUMCVSS 4.7EG 4.7
2024-08-01
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing …
CVE-2024-39694MEDIUMCVSS 4.7EG 4.7
2024-07-31
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url…
CVE-2024-41801MEDIUMCVSS 4.7EG 4.7
2024-07-25
OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remo…
CVE-2024-20400MEDIUMCVSS 4.7EG 4.7
2024-07-17
A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP …
CVE-2024-20369MEDIUMCVSS 4.7EG 4.7
2024-05-15
A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to impr…
CVE-2024-33930MEDIUMCVSS 4.7EG 4.7
2024-05-02
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ILLID Share This Image.This issue affects Share This Image: from n/a through 1.97.
CVE-2024-25676MEDIUMCVSS 4.7EG 4.7
2024-05-01
An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads to both open redirection and out-of-band resource loading.
CVE-2024-33584MEDIUMCVSS 4.7EG 4.7
2024-04-29
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Deepen Bajracharya Video Conferencing with Zoom.This issue affects Video Conferencing with Zoom: from n/a through 4.4.4.
CVE-2024-32129MEDIUMCVSS 4.7EG 4.7
2024-04-15
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Freshworks Freshdesk (official).This issue affects Freshdesk (official): from n/a through 2.3.6.
CVE-2024-31282MEDIUMCVSS 4.7EG 4.7
2024-04-10
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7.
CVE-2024-31253MEDIUMCVSS 4.7EG 4.7
2024-04-10
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3.
CVE-2023-34020MEDIUMCVSS 4.7EG 4.7
2024-03-27
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.

Map vulnerabilities like CWE-601 to your infrastructure

EchelonGraph correlates every CVE — across CWE-601 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →