TI-2021-07311 Aliases CVE-2021-25033 GHSA-gxrq-7hvq-53q3

Noptin < 1.6.5 - Open Redirect

LOW 32CWE-601Published 2022-02-14 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

Why it matters now

EPSS 0.02303 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed WordPress Newsletter Plugin – Noptin (Unknown): 1.6.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	WordPress Newsletter Plugin – Noptin	1.6.5 to before 1.6.5	1.6.5	Patch available	CNA

WordPress Newsletter Plugin – Noptin VendorUnknown Affected 1.6.5 to before 1.6.5 Fixed in 1.6.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:noptin:noptin::::::wordpress::*	before 1.6.5	Vulnerable	Noptin

cpe:2.3:a:noptin:noptin:*:*:*:*:*:wordpress:*:* Versions before 1.6.5 Vulnerable ·Noptin

Remediation

Fix · CNA WordPress Newsletter Plugin – Noptin (Unknown) Fixed in 1.6.5

Timeline

2026-10-02 Threatist record created from CVE-2021-25033
2026-10-03 Alias added: GHSA-gxrq-7hvq-53q3

References

Exploit 1

https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c

Patch 1

https://plugins.trac.wordpress.org/changeset/2639592

TI-2022-23149 WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences