CVE-2014-2598: Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for Wor...

Security readout for executives and security teams

This affects WordPress sites using Quick Page/Post Redirect plugin versions before 5.0.5. An attacker could abuse an administrator’s logged-in session to save malicious script through the plugin’s redirect update function. The bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is limited to WordPress installations with the Quick Page/Post Redirect plugin installed below version 5.0.5. Internet-facing admin access increases practical risk, but the source bundle does not identify affected CPEs or broader product versions. Prioritize remediation for public WordPress sites, especially business-critical sites or sites with many administrators. This is not KEV-listed, but stored XSS in an admin-managed plugin can create account and site integrity risk. Mitigation focus: Upgrade Quick Page/Post Redirect to version 5.0.5 or later.; If upgrade is unavailable, disable the plugin until vendor guidance is confirmed.; Restrict WordPress administrator access to trusted users and networks where practical..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.