Open Redirect
CVE-2025-68602
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2.
AnalysisAI
Open redirect vulnerability in Scott Paterson Accept Donations with PayPal & Stripe WordPress plugin (versions <= 1.5.2) enables attackers to craft malicious URLs that redirect users to untrusted sites, facilitating phishing attacks. The vulnerability requires user interaction (UI:R) but affects the plugin's core donation handling, allowing an unauthenticated attacker to chain this with social engineering to compromise user credentials or distribute malware through redirects to fraudulent payment pages.
Technical ContextAI
The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect), a common web application flaw where user-controlled input is used in redirect operations without proper validation. The affected product is the 'easy-paypal-donation' WordPress plugin, which integrates PayPal and Stripe payment processing into WordPress sites. The plugin's donation form or callback mechanism fails to validate redirect URLs before redirecting users, allowing attackers to inject arbitrary URLs. This is particularly dangerous in the payment context because users may trust redirects originating from donation pages, making phishing attacks more credible.
Affected ProductsAI
Scott Paterson Accept Donations with PayPal & Stripe (easy-paypal-donation) WordPress plugin in all versions from initial release through 1.5.2 inclusive. This plugin is hosted in the official WordPress plugin repository and is likely installed on thousands of donation-focused WordPress sites.
RemediationAI
Update the Accept Donations with PayPal & Stripe plugin to a patched version released after 1.5.2 (exact patch version not specified in available data; consult the Patchstack advisory for the specific fixed release). Site administrators should immediately upgrade through the WordPress plugin dashboard. As an interim workaround pending patch availability, disable the plugin entirely if donation processing can be deferred, or restrict redirect functionality through .htaccess rules or WordPress security plugins that validate redirect URLs. Reference the vulnerability details at https://patchstack.com/database/Wordpress/Plugin/easy-paypal-donation/vulnerability/wordpress-accept-donations-with-paypal-plugin-1-5-1-open-redirection-vulnerability?_s_id=cve for confirmation of the patched version.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today