CVE-2025-68509: WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-24 · updated 2026-10-07
Weakness: CWE-601

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.

Affected products

specialk User Submitted Posts – Enable Users to Submit Posts from the Front End: through 20251121

References

https://patchstack.com/database/Wordpress/Plugin/user-submitted-posts/vulnerability/wordpress-user-submitted-posts-plugin-20251121-open-redirection-vulnerability?_s_id=cve

Get alerted when CVE-2025-68509 or the next vulnerability affects your stack