Vulnerabilities / Sermon Browser / WPSEC-2026-1180
Sermon Browser <= 0.45.22 - Unauthenticated Open Redirect via 'url' Parameter
Medium 6.1
CWE-601Fixed in 0.46.0
- ID
- WPSEC-2026-1180
- Plugin
- Sermon Browser (sermon-browser)
- Affected
- all versions before 0.46.0
- Remediation
- Update to 0.46.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-17
- Attack surface
- Sermon Browser on WPSec AttackSurface
- Fix released
- Published
Description
The sermon-browser plugin for WordPress is vulnerable to Open Redirect via the 'url' parameter of the show request in all versions up to, and including, 0.45.22, due to missing validation of the redirect target. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites if they can get the user to click a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-1180/
- https://plugins.svn.wordpress.org/sermon-browser/tags/0.46.0/
- https://wordpress.org/plugins/sermon-browser/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS