Better Random Redirect
Better Random Redirect has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Better Random Redirect has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. Better Random Redirect is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-50021Better Random Redirect <= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Better Random Redirect
Author
Robert Peake
Based on the original Random Redirect, this plugin enables efficient, easy random redirection to a post. Supports setting a category for all random redirects, shortcodes to generate URLs that can override the default category, and setting your own redirector URL. Designed to scale to handle high-traffic websites with thousands of posts by using a more efficient strategy than most other redirection plugins employ. Based on the original Random Redirect by Matt Mullenweg https://wordpress.org/plugins/random-redirect/ Special thanks to Tim Green for providing additional quality assurance testing on the popular rattle.com website.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C