The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.01908·Published 2022-04-25·Fixed in 1.5.2CWE-601