CVE-2026-88791

LowCVSS 3.4/10Last modified Sep 30, 2026

Description

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
UnknownSafe Redirect Manager< 2.3.0

References

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-887928.8The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionarCVE-2026-887938.8The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a CVE-2026-887948.2Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML fileCVE-2026-887959.0The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from datCVE-2026-887977.1The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it tCVE-2026-887985.3The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage keyCVE-2026-88806.4The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes)CVE-2026-888027.5The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capaCVE-2026-888049.6An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the RanCVE-2026-888058.1Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. CVE-2026-888067.5A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.CVE-2026-888078.9A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X cl