title: Page Builder KingComposer <= 2.9.6 - Open Redirect
description: The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
problem types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
affected:
{
product: Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
vendor: Unknown
versions:
lessThanOrEqual: 2.9.6, status: affected, version: 2.9.6, versionType: custom
}