The vulnerability CVE-2025-39404 involves an Open Redirect issue in the Heateor Support Sassy Social Share plugin, versions up to 3.3.73. This flaw allows attackers to redirect users from a legitimate URL to an untrusted external site, which can be leveraged for phishing. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality impact. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to users being redirected to malicious websites, increasing the risk of phishing attacks. The confidentiality impact is low, and there is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs generated by the affected plugin and consider disabling or replacing the plugin if possible to mitigate phishing risks.