CVE-2021-25028: Event Tickets < 5.2.2 - Open Redirect
Published Jan 24, 2022
·Updated
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribeticketsredirectto parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
Affected Software
1 affected component
Tri Event Tickets WordPress<5.2.2
Event History
Jan 24, 2022
CVE Published
via MITRE·08:01 AM
Data Sourced
via MITRE·08:01 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-25028?
CVE-2021-25028 has a medium severity rating due to its potential for arbitrary redirection.
2
How do I fix CVE-2021-25028?
To fix CVE-2021-25028, update the Event Tickets WordPress plugin to version 5.2.2 or later.
3
What type of attack does CVE-2021-25028 enable?
CVE-2021-25028 enables an arbitrary redirect attack, which can be exploited by attackers to direct users to malicious sites.
4
Which versions of the Event Tickets plugin are affected by CVE-2021-25028?
All versions of the Event Tickets plugin prior to 5.2.2 are affected by CVE-2021-25028.
5
How can I determine if my site is vulnerable to CVE-2021-25028?
You can check if your site is vulnerable to CVE-2021-25028 by confirming the version of the Event Tickets plugin installed on your WordPress site.