Inisev Redirection vulnerabilities

Latest Inisev Redirection CVEs

Newest publication first

1. CVE-2023-0958 Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

   Published 2023-07-28

   Medium·CVSS 6.5 EPSS 0.69%

   Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticate...

2. CVE-2023-3977 Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

   Published 2023-07-28

   Medium·CVSS 4.3 EPSS 0.61%

   Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it...

3. CVE-2023-1331 Redirection < 1.1.5 - Plugin Reset via CSRF

   Published 2023-04-17

   Medium·CVSS 6.5 EPSS 0.33%

   The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.

4. CVE-2023-1330 Redirection < 1.1.4 - Redirect Creation via CSRF

   Published 2023-04-03

   Medium·CVSS 6.5 EPSS 0.34%

   The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.