CVE-2025-39599: 
WordPress vulnerability analysis and mitigation

URL Redirection to Untrusted Site ('Open Redirect') vulnerability affects Webilia Inc.'s Listdom WordPress plugin through version 4.0.0. The vulnerability was discovered by Nguyen Xuan Chien and publicly disclosed on April 16, 2025 (NVD, Patchstack).

The vulnerability is classified as an Open Redirect issue (CWE-601) with a CVSS v3.1 base score of 4.7 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), and requires user interaction (UI:R). The scope is changed (S:C) with low confidentiality impact (C:L) and no impact on integrity (I:N) or availability (A:N) (Patchstack).

The vulnerability allows malicious actors to redirect users from legitimate sites to potentially malicious ones. Users could be tricked into visiting a legitimate site only to be redirected to a malicious site, potentially leading to phishing incidents (Patchstack).

The vulnerability can be exploited by unauthenticated attackers and requires user interaction. The redirect URL is not properly validated, making it possible to redirect users to malicious sites (Patchstack).

Users are advised to update to version 4.1.0 or later which contains the fix for this vulnerability. The security issue has a low severity impact and is unlikely to be exploited, but updating is recommended as a security measure (Patchstack).