WP Front User Submit < 5.0.0 – Open Redirect | CVE 2025-12569

Description

The plugin does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue

Proof of Concept

1. Add the `[fus_form_register]` shortcode to a post/page
2. Open the post page: `https://example.com/2025/07/24/redirect-test/?redirect=https://evil.com`
3. Submit the registration form and be redirected to `evil.com`

Affects Plugins

front-editor

Fixed in 5.0.0

References

CVE

CVE-2025-12569

Classification

Type

REDIRECT

OWASP top 10

A1: Injection

CWE

CWE-601

CVSS

4.3 (medium)

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

bobmatyas

Verified

Yes

WPVDB ID

37586572-33f9-4365-bfce-7db277a8df72

Timeline

Publicly Published

2025-11-03 (about 2 months ago)

Added

2025-11-03 (about 2 months ago)

Last Updated

2025-11-03 (about 2 months ago)

Other

Published

Title

Published

2025-05-20

Title

Affiliate Sales in Google Analytics and other tools < 2.0.1 - Open Redirect

Published

2024-06-19

Title

Export WP Page to Static HTML/CSS < 2.2.3 - Open Redirect

Published

2022-02-16

Title

Page Builder KingComposer <= 2.9.6 - Open Redirect

Published

2023-10-25

Title

Parcel Pro < 1.6.12 - Open Redirect

Published

2025-04-16

Title

Listdom < 4.1.0 - Open Redirect