CVE-2021-25111

CVE-2021-25111: English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect

Vendor Unknown

Product English WordPress Admin

Weakness CWE-601 · Open redirect

Published April 25, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue

Key dates

02Disclosure timeline

April 25, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-25111 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html AskarLabs — CWE-601 write-up URL Redirection to Untrusted Site (Open Redirect)

Related vulnerabilities

04Related CVE

CVE-2025-30859 WordPress AliNext plugin <= 3.5.1 - Open Redirection vulnerability CVE-2025-30884 WordPress Bit Integrations plugin <= 2.4.10 - Open Redirection vulnerability CVE-2025-66062 WordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerability CVE-2026-39484 WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability CVE-2026-25392 WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability