WordPress Newsletter Plugin 'nr' Parameter Multiple Open Redirection Vulnerabilities

Bugtraq ID:	72960
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 04 2015 12:00AM
Updated:	Mar 04 2015 12:00AM
Credit:	Wang Jing
Vulnerable:	Satollo Newsletter 2.6.4 Satollo Newsletter 2.6.3 Satollo Newsletter 2.5.3 Satollo Newsletter 2.5.2 Satollo Newsletter 2.5.1 Satollo Newsletter 2.5 Satollo Newsletter 2.6.4.4 Satollo Newsletter 2.6.4.3 Satollo Newsletter 2.6.4.2 Satollo Newsletter 2.6.4.1 Satollo Newsletter 2.5.3.3 Satollo Newsletter 2.5.3.2 Satollo Newsletter 2.5.3.1 Satollo Newsletter 2.5.2.3 Satollo Newsletter 2.5.2.2 Satollo Newsletter 2.5.2.1 Satollo Newsletter 2.5.1.5 Satollo Newsletter 2.5.1.4 Satollo Newsletter 2.5.1.3 Satollo Newsletter 2.5.1.2 Satollo Newsletter 2.5.1.1 Satollo Newsletter 2.5.0.1
Not Vulnerable:

WordPress Newsletter Plugin 'nr' Parameter Multiple Open Redirection Vulnerabilities

The Newsletter plugin for WordPress is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can leverage these issues by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing
attacks. Other attacks are possible.

WordPress Newsletter Plugin 'nr' Parameter Multiple Open Redirection Vulnerabilities

References:

• Newsletter Product Page (Satollo)
  
• Satollo Home Page (Satollo)