title: WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open Redirection
description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
problem types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
affected:
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: cf7-constant-contact
product: Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
vendor: CRM Perks
versions:
changes: [at: 1.1.5, status: unaffected], lessThanOrEqual: 1.1.4, status: affected, version: n/a, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update to 1.1.5 or a higher version.