Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter

Description

The plugin does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.