This vulnerability involves an Open Redirect issue in the ElementsReady Addons for Elementor plugin by quomodosoft, specifically in versions up to 6.4.2. An attacker can exploit this flaw to redirect users to arbitrary external URLs, potentially facilitating phishing or social engineering attacks. The vulnerability requires no privileges and user interaction is needed to trigger the redirect. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality impact.

The impact is limited to potential redirection of users to untrusted sites, which could be used in phishing or social engineering attacks. There is no direct impact on confidentiality, integrity, or availability of the affected system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious about clicking on URLs generated by or involving the affected plugin. Monitoring vendor channels for updates is recommended.