CVE-2025-14783

The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.

• CWE-640

• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/blocks/views/forms/lost-password.php#L24
• https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/users/lost-password.php#L187
• https://plugins.trac.wordpress.org/changeset/3426524/easy-digital-downloads/trunk/includes/users/lost-password.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3c0fb43c-f576-412e-a144-4725356ed9a0?source=cve

Published

Dec 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14777A flaw was found in Keycloak. An IDOR (Broken Access Control…6
• CVE-2025-14778A flaw was found in Keycloak. A significant Broken Access Co…5.4
• CVE-2025-14779The Secret Type Management REST API does not correctly isola…3.8
• CVE-2025-1478An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-14780A vulnerability was detected in Xiongwei Smart Catering Clou…6.3
• CVE-2025-14782The Forminator Forms – Contact Form, Payment Form & Custom F…5.3
• CVE-2025-14785The Website Builder by SeedProd - Theme Builder, Landing Pag…6.4
• CVE-2025-1479An open debug interface was reported in the Legion Space sof…5.3
• CVE-2025-14790IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …6.5
• CVE-2025-14792The Key Figures plugin for WordPress is vulnerable to Stored…4.4
• CVE-2025-14793The DK PDF – WordPress PDF Generator plugin for WordPress is…5
• CVE-2025-14795The Stop Spammers Classic plugin for WordPress is vulnerable…4.3