The vulnerability exists in the WPWebinarSystem WebinarPress plugin versions up to 1.33.28. It allows an attacker to craft URLs that when visited by a user are redirected to an arbitrary third‑party domain. This flaw is classified as CWE‑601 and is commonly exploited for phishing or social engineering attacks. Since the redirect occurs without validating the target domain, a malicious actor can lure legitimate site visitors to malicious websites, potentially compromising credentials or delivering malware.

WordPress sites that run the WebinarPress plugin version 1.33.28 or earlier are affected. The issue is present in the lite edition of the plugin for WordPress.

The CVSS score of 4.7 indicates moderate overall risk, but the EPSS score of less than 1% suggests that the likelihood of exploitation in the near term is low. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trick a user into clicking a manipulated link, but the lack of strong validation means the exploitation path is straightforward when the vector is available.