Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access

The plugin does not restrict access to published and non protected posts/pages when the maintenance mode is enabled, allowing unauthenticated users to access them. id: CVE-2023-1263 info: name: Coming Soon & Maintenance 4.1.7 - Unauthenticated Post/Page Access author: r3Y3r53 severity: medium...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

CVE-2023-46615

CVE-2023-46615 KD Coming Soon = 1.7 - Iniezione di oggetti PHP non autenticata tramite cetitle Descrizione: Il plugin KD Coming Soon per WordPress è vulnerabile all'iniezione di oggetti PHP in tutte le versioni fino alla 1.7 inclusa, tramite la deserializzazione dell'input non fidato cetitle nell...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Controlli di accesso impropri nelle chiamate AJAX Subscriber+ Descrizione: Alcune chiamate AJAX del plugin non verificano correttamente le capacità e i token CSRF, portando a problemi come lettura arbitraria di post, esportazione della lista ...

CVE-2023-2033

CVE-2023-2033 Prossimamente...

CVE-2026-13416

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

WordPress CMP plugin < 4.1.18 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

EUVD-2026-66869

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

CVE-2026-13414

CVE-2026-13414 affects the CMP – Coming Soon & Maintenance WordPress plugin in versions before 4.1.18 . The vulnerability is an unauthenticated maintenance mode disable via the cmp_disable_comingsoon_ajax AJAX action. The plugin does not perform authorization checks on this action and relies on a...

CVE-2026-13414 CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain and exposed to anonymous visitors on others, allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a...

WordPress CMP plugin < 4.1.18 - Unauthenticated Maintenance Mode Disable vulnerability

Unauthenticated Maintenance Mode Disable vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

CVE-2026-13416

CVE-2026-13416 is a stored XSS in the CMP – Coming Soon & Maintenance WordPress plugin (versions

CVE-2026-13416 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to inject...

CVE-2026-34896

Cross-Site Request Forgery CSRF vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under Construction, Coming Soon & Maintenance Mode: from n/a through 2.1.1...

PT-2026-42767

Name of the Vulnerable Software and Affected Versions DOMPurify version 3.4.4 Description DOMPurify allows the element by default, which enables a bypass of the sanitization process. This occurs because browsers may re-clone an XSS payload after the sanitizer has already processed the subtree...

JLSEC-2026-328

A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MMstrndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and...

WordPress CMP - Coming Soon & Maintenance Plugin by NiteoThemes plugin <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution vulnerability

WordPress CMP - Coming Soon & Maintenance Plugin by NiteoThemes plugin = 4.1.16 - Missing Authorization to Authenticated Administrator+ Arbitrary File Upload and Remote Code Execution vulnerability discovered by ll in WordPress Plugin CMP – Coming Soon & Maintenance versions = 4.1.16...

EUVD-2026-23654

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the cmpthemeupdateinstall AJAX action. This is due to the function only checking for the publishpages...

CVE-2026-6518

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the cmpthemeupdateinstall AJAX action. This is due to the function only checking for the publishpages...

WordPress plugin CMP – Coming Soon & Maintenance Plugin by NiteoThemes 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...