WordPress Plugin Vulnerabilities

WP Gravity Forms HubSpot < 1.2.6 - Open Redirect

Description

The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Affects Plugins

Plugin icon
gf-hubspot
Fixed in 1.2.6

References

CVE
CVE-2025-60151
URL
https://patchstack.com/database/wordpress/plugin/gf-hubspot/vulnerability/wordpress-wp-gravity-forms-hubspot-plugin-1-2-5-open-redirection-vulnerability

Classification

Type
REDIRECT
OWASP top 10
A1: Injection
CWE
CWE-601
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bonds
Verified
No
WPVDB ID
964d30b8-2f57-46b4-9361-2f89e64791cd

Timeline

Publicly Published
2025-09-26 (about 10 months ago)
Added
2025-09-30 (about 9 months ago)
Last Updated
2025-10-07 (about 9 months ago)

Other

Published
Title
Published
2021-01-21
Title
Digital Climate Strike WP <= 1.0.0 - Redirect to Malicious Website due to Compromised JS Asset
Published
2023-12-27
Title
Advanced Access Manager < 6.9.19 - Open Redirect
Published
2014-06-02
Title
Grimag < 1.1.1 - Open Redirection
Published
2025-05-20
Title
Affiliate Sales in Google Analytics and other tools < 2.0.1 - Open Redirect
Published
2024-05-23
Title
Themify Builder < 7.5.8 - Open Redirect