There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.03052·Published 2021-04-05·Fixed in 1.111CWE-601
