The Login Widget With Shortcode plugin for aviplugins.com contains an Open Redirect vulnerability (CVE-2024-54255) in versions up to 6.1.2. This flaw allows attackers to craft URLs that redirect users to untrusted external websites, potentially enabling phishing attacks by misleading users about the destination. The vulnerability requires user interaction (UI:R) and has no required privileges (PR:N). The attack vector is network-based (AV:N) with low attack complexity (AC:L). The vulnerability impacts confidentiality to a limited extent (C:L) but does not affect integrity or availability.

Successful exploitation can lead to users being redirected to malicious websites, increasing the risk of phishing attacks. There is limited impact on confidentiality, and no direct impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs generated by the affected plugin. Monitoring vendor channels for updates is recommended.