CVE-2025-60151: 
WordPress vulnerability analysis and mitigation

An open redirect vulnerability (CVE-2025-60151) was discovered in CRM Perks WP Gravity Forms HubSpot plugin (gf-hubspot) versions through 1.2.5. The vulnerability was disclosed on October 22, 2025, and allows potential phishing attacks through URL redirection to untrusted sites (NVD).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site). According to the CVSS 3.1 scoring system, it received a base score of 4.7 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (NVD).

The vulnerability primarily impacts the confidentiality of the system with a low severity rating, while integrity and availability remain unaffected. The main risk is associated with potential phishing attacks through malicious URL redirections (NVD).

Users are advised to update their WP Gravity Forms HubSpot plugin to versions newer than 1.2.5 when available. No specific workarounds have been publicly disclosed (Patchstack).