{"error":0,"message":null,"data":{"name":"Quick Page\/Post Redirect Plugin","plugin":"quick-pagepost-redirect-plugin","link":"https:\/\/wordpress.org\/plugins\/quick-pagepost-redirect-plugin\/","latest":"1686221220","closed":1,"closed_reason":"security-issue","closed_date":"2026-04-14","vulnerability":[{"uuid":"e9a34e8de5c7a6b784a0d33737c6daea60c8efee79fc85c279b355ee4bb3fecb","name":"Quick Page\/Post Redirect Plugin [quick-pagepost-redirect-plugin] < 5.0.5 (closed)","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.5","max_operator":"lt","unfixed":"0","closed":"1"},"source":[{"id":"CVE-2014-2598","name":"CVE-2014-2598","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2014-2598","description":"[en] Cross-site request forgery (CSRF) vulnerability in the Quick Page\/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin\/admin.php.","date":"2015-01-05"},{"id":"3f2870c94456dc4c989afd8e64f475b1f2d290bf","name":"Quick Page\/Post Redirect Plugin < 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/quick-pagepost-redirect-plugin\/quick-pagepost-redirect-plugin-505-cross-site-request-forgery-to-stored-cross-site-scripting","description":"Cross-site request forgery (CSRF) vulnerability in the Quick Page\/Post Redirect plugin before 5.0.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the quickppr_redirects[request][] parameter in the redirect-updates page to wp-admin\/admin.php.","date":"2014-08-01"},{"id":"84054834-7df6-4848-a69d-85735c46e98e","name":"Quick Page Post Redirect 5.0.4 - redirect-updates.php Multiple Admin Function CSRF","link":"https:\/\/wpscan.com\/vulnerability\/84054834-7df6-4848-a69d-85735c46e98e","description":"The Quick Page\/Post Redirect Plugin WordPress plugin was affected by a redirect-updates.php Multiple Admin Function CSRF security vulnerability.","date":null},{"id":"e89614a3-477d-49b6-a817-4ae303f1954c","name":"Quick Page Post Redirect 5.0.4 - redirect-updates.php quickppr_redirects Parameter Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/e89614a3-477d-49b6-a817-4ae303f1954c","description":"The Quick Page\/Post Redirect Plugin WordPress plugin was affected by a redirect-updates.php quickppr_redirects Parameter Stored XSS security vulnerability.","date":null}],"impact":{"cvss":{"version":null,"vector":null,"av":null,"ac":null,"pr":null,"ui":null,"s":null,"c":null,"i":null,"a":null,"score":"0.0","severity":null,"exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}]}},{"uuid":"eaab8db1619fbb52b886041e36a603856d261c9468be4afa02675a65b5627a7d","name":"Quick Page\/Post Redirect Plugin [quick-pagepost-redirect-plugin] < 5.2.0 (closed)","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.0","max_operator":"lt","unfixed":"0","closed":"1"},"source":[{"id":"e3ffca47b1bb93ab7bf6a25b4de09a3428b4e568","name":"WordPress Quick Page\/Post Redirect plugin <= 5.1.9 - Authenticated Settings Change vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/quick-pagepost-redirect-plugin\/vulnerability\/wordpress-quick-page-post-redirect-plugin-5-1-9-authenticated-settings-change-vulnerability","description":"Authenticated Settings Change vulnerability discovered by NinTechNet in WordPress Quick Page\/Post Redirect plugin (versions <= 5.1.9).","date":"2020-04-28"}],"impact":[]},{"uuid":"5958689a009c0646be3d9ea92fdc675cf987331afc837183fa112ecf754a8a32","name":"Quick Page\/Post Redirect Plugin [quick-pagepost-redirect-plugin] < 5.0.4 (closed)","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.0.4","max_operator":"lt","unfixed":"0","closed":"1"},"source":[{"id":"c11c274971bc692af514f7e5a7902ff913678049","name":"WordPress Quick Page\/Post Redirect Plugin 5.0.3 - Multiple Vulnerabilities","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/quick-pagepost-redirect-plugin\/vulnerability\/wordpress-quick-page-post-redirect-plugin-5-0-3-multiple-vulnerabilities","description":"WordPress Quick Page\/Post Redirect plugin is prone to multiple vulnerabilities, such as CSRF and XSS. Because of this vulnerabilities, an admin user can be persuaded to visit a URL of the attacker\u2019s choosing, the attacker can insert arbitrary JavaScript into an admin page. In that way the admin's browser can create or delete posts, create new admin users or exploit vulnerabilities.\nUpgrade to version 5.0.5.","date":"2014-04-14"}],"impact":[]},{"uuid":"5392692e6a5eafc130fda5b415e23151e114508a88ce0c26ab1656ced70ef43a","name":"Quick Page\/Post Redirect Plugin [quick-pagepost-redirect-plugin] < 5.2.0 (closed)","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.0","max_operator":"lt","unfixed":"0","closed":"1"},"source":[{"id":"cad5a01c2ab8d4f5f791d2ded9d9890aeb845f05","name":"Quick Page\/Post Redirect Plugin <= 5.1.9 - Redirect Security Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/quick-pagepost-redirect-plugin\/quick-pagepost-redirect-plugin-519-redirect-security-bypass","description":"The Quick Page\/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9. This makes it possible for low-privileged attackers to interact with the plugin settings and to create a redirect link that would forward all traffic to an external malicious website.","date":"2020-04-28"},{"id":"CVE-2020-36699","name":"CVE-2020-36699","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2020-36699","description":"[en] The Quick Page\/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9. This makes it possible for low-privileged attackers to interact with the plugin settings and to create a redirect link that would forward all traffic to an external malicious website.","date":"2023-06-07"},{"id":"d658436a-0011-42d2-a147-c471805ca1d1","name":"Quick Page\/Post redirect &lt; 5.2.0 - Authenticated Settings Update","link":"https:\/\/wpscan.com\/vulnerability\/d658436a-0011-42d2-a147-c471805ca1d1","description":"A lack of capability check and a weak security nonce could allow a low-privileged user such as a contributor to interact with the plugin settings and to create a redirect link that would forward all traffic to an external malicious website. Redirections are performed via the &#039;Location&#039; header","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-284","name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"7658e7d0c0ab97fb7fd578891ace4a346256e0f1e853f56aeb4016d123e6f34a","name":"Quick Page\/Post Redirect Plugin [quick-pagepost-redirect-plugin] < 5.2.4 (closed)","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.4","max_operator":"lt","unfixed":"0","closed":"1"},"source":[{"id":"CVE-2023-25063","name":"CVE-2023-25063","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-25063","description":"[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anadnet Quick Page\/Post Redirect Plugin plugin <=\u00a05.2.3 versions.","date":"2023-08-08"},{"id":"d1ca63412e67eda30bb95e876c552f920ff47278","name":"WordPress  Quick Page\/Post Redirect Plugin  <= 5.2.3 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/quick-pagepost-redirect-plugin\/vulnerability\/wordpress-quick-page-post-redirect-plugin-plugin-5-2-3-cross-site-scripting-xss","description":"No patched version is available. No reply from the vendor.\nJustiice discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Quick Page\/Post Redirect Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has not been known to be fixed yet.","date":"2023-05-12"},{"id":"966c4f949bcc133ff586cb7efc7dff55d3030766","name":"Quick Page\/Post Redirect <= 5.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/quick-pagepost-redirect-plugin\/quick-pagepost-redirect-523-authenticated-administrator-stored-cross-site-scripting-via-settings","description":"The Quick Page\/Post Redirect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only impacts multi-site installations and installations where unfiltered_html has been disabled.","date":"2023-05-12"},{"id":"46fc0b5c-25ee-481d-8e65-8e0b0a787601","name":"Quick Page\/Post Redirect &lt; 5.2.4 - Admin+ Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/46fc0b5c-25ee-481d-8e65-8e0b0a787601","description":"The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"5.9","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"5.9","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}],"supplychain":[{"verdict":"malicious","audit_id":13,"affected_versions":{"min_version":"5.2.1","min_operator":"ge","max_version":null,"max_operator":null},"baseline_version":"5.2.1","head_version":"5.2.4","ioc_count":12,"closed_by_wporg":true,"c2_infrastructure":[],"signals":[],"wpbeacon_url":"https:\/\/wpbeacon.io\/audits\/13\/","published_at":"2026-04-09"}]},"updated":"1776130854"}