CVE-2015-5461: Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin befo...

Security readout for executives and security teams

CVE-2015-5461 is an open redirect in the StageShow WordPress plugin before 5.0.9. A malicious link could make a trusted WordPress site send visitors to an attacker-controlled site, supporting phishing or brand abuse. It does not show direct server compromise in the provided sources. Exposure is likely limited to WordPress sites with the StageShow plugin installed below version 5.0.9. Public-facing sites are the main concern because attackers could distribute crafted links that appear to start from the trusted domain. Treat this as a moderate web trust issue. It is unlikely to be an emergency server compromise based on the bundle, but it can damage brand trust and support phishing if an exposed WordPress site still runs an old plugin version. Mitigation focus: Upgrade StageShow to version 5.0.9 or later.; Remove StageShow where it is no longer required.; Review vendor changelog and Trac notes before deploying changes..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.