CVE-2021-24838: Bologer Anycomment

Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days.

The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.

Affected products

• Bologer Anycomment: before 0.3.5 (fixed in 0.3.5)

Published 2022-01-17. Last modified 2026-06-17.