CVE-2025-47454

WordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection Vulnerability

Published May 7, 2025 CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.

Analysis

Technical impact

The vulnerability is an open redirection flaw that lets attackers force users to be redirected to an untrusted site, facilitating phishing and other social‑engineering attacks. The weakness arises from improper validation of redirect URLs within the Gravity Forms Dynamics CRM plugin, allowing an attacker to craft a URL that, when visited by a user, immediately sends them to a malicious domain.

Affected Systems

The flaw affects the WordPress plugin "CRM Perks WP Gravity Forms Dynamics CRM" for all released versions up to and including 1.1.4. WordPress sites that have installed or are running this plugin version are vulnerable.

Risk and Exploitability

With a CVSS score of 4.7 the vulnerability is classified as moderate severity, and its EPSS score of less than 1% indicates a low probability of exploitation. It is not currently listed in the CISA KEV catalog. Attackers would need to lure a site user to a crafted URL, a scenario that is feasible through email or malicious links. Due to its low EPSS and lack of advanced exploitation requirements, the risk remains moderate under normal operational conditions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CRM Perks

WP Gravity Forms Dynamics CRM

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.4

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade CRM Perks WP Gravity Forms Dynamics CRM to the latest released version that removes the open‑redirection flaw
If the plugin is no longer needed, uninstall it entirely from the WordPress installation
Configure the plugin’s redirect settings to whitelist only approved domains or disable open redirection functionality if customization allows

Generated by OpenCVE AI on April 30, 2026 at 20:41 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-13859	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM allows Phishing. This issue affects WP Gravity Forms Dynamics CRM: from n/a through 1.1.4.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.328% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM allows Phishing. This issue affects WP Gravity Forms Dynamics CRM: from n/a through 1.1.4.	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
Title	WordPress WP Gravity Forms Dynamics CRM <= 1.1.4 - Open Redirection Vulnerability	WordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection Vulnerability
References	https://patchstack.com/database/wordpress/plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`

Jul 14, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00033}`	epss `{'score': 0.00038}`

May 7, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 7, 2025 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM allows Phishing. This issue affects WP Gravity Forms Dynamics CRM: from n/a through 1.1.4.
Title		WordPress WP Gravity Forms Dynamics CRM <= 1.1.4 - Open Redirection Vulnerability
Weaknesses		CWE-601
References		https://patchstack.com/database/wordpress/plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'}`