CVE-2025-47456: 
WordPress vulnerability analysis and mitigation

A URL Redirection to Untrusted Site ('Open Redirect') vulnerability has been identified in CRM Perks WP Gravity Forms Zendesk through version 1.1.2. The vulnerability was discovered by Nguyen Xuan Chien on April 19, 2025, and was publicly disclosed on May 7, 2025. This security issue affects the WordPress plugin WP Gravity Forms Zendesk (NVD, Patchstack).

The vulnerability has been assessed with a CVSS v3.1 Base Score of 4.7 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The issue stems from insufficient validation of redirect URLs, which can be exploited without authentication (Patchstack).

The vulnerability could allow malicious actors to redirect users from legitimate sites to malicious ones, potentially leading to phishing incidents. When users visit what appears to be a legitimate site, they could be redirected to a malicious site without proper validation (Patchstack).

The vulnerability has been patched in version 1.1.3 of the WP Gravity Forms Zendesk plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).