PT-2025-15411 · WordPress · Advanced Advertising System

Gabriele Zuddas · Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-3433

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Advanced Advertising System plugin for WordPress versions up to and including 1.3.1

Description: The issue arises from insufficient validation of the redirect URL provided through the redir parameter. This allows unauthenticated attackers to redirect users to potentially malicious sites if they can trick them into performing a specific action.

Recommendations: For versions up to and including 1.3.1, update to a version higher than 1.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the redir parameter to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-3433

Affected Products

Advanced Advertising System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-3433 · Security Note
• https://t.me/cvetracker/21118 · Telegram Post
• https://twitter.com/CVEnew/status/1909528269931843952 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1909678956933972469 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/72a56589-9dc0-47a7-bb68-e31f84a639ee?source=cve · Note
• https://t.me/cvedetector/22441 · Telegram Post
• https://plugins.trac.wordpress.org/browser/advanced-advertising-system/trunk/shortcode.php#L165 · Note