CVE-2021-38343: Kylephillips Nested Pages

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.

Affected products

• Kylephillips Nested Pages: up to and including 3.1.15

Published 2021-08-30. Last modified 2026-06-17.