WordPress plugin Coming Soon Landing Page 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Coming Soon - Under Construction <= 1.2.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed As admin, put the following payload in the "More text information" settings of the plugin: The XSS will be triggered...

CVE-2022-1576

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

CVE-2022-1576

The CVE concerns the WP Maintenance Mode & Coming Soon WordPress plugin (pre-2.4.5). The root cause is missing CSRF protection when emptying the subscribed users list, potentially allowing an attacker to induce a logged-in admin to perform this action via a CSRF attack. Reported impact is unautho...

WordPress plugin Maintenance Mode & Coming Soon 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Maintenance Mode...

CVE-2022-1593

CVE-2022-1593 affects the WordPress Site Offline or Coming Soon plugin (versions 1.6.6 and earlier). The root cause is missing CSRF checks and inadequate sanitisation/escaping in settings updates, enabling a logged-in administrator to inject stored XSS payloads via CSRF. Several sources corrobora...

WordPress plugin Site Offline or Coming Soon 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Site Offline or Coming Soon plugin version 1.6.6 and earlier are vulnerable to cross-site request...

PT-2022-13990 · WordPress · The Site Offline/Coming Soon

Name of the Vulnerable Software and Affected Versions: The Site Offline or Coming Soon WordPress plugin versions 1.6.6 and earlier Description: The issue is related to the lack of CSRF check when updating settings, as well as insufficient sanitisation and escaping in some settings. This allows...

CVE-2022-1945

The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfilteredhtml is disallowed for example in multisite setup...

WordPress plugin Coming Soon and Maintenance by Colorlib 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Coming Soon...

WordPress WP Maintenance Mode & Coming Soon plugin <= 2.4.4 - Subscribed Users Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Subscribed Users Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress WP Maintenance Mode & Coming Soon plugin versions = 2.4.4. Solution Update the WordPress WP Maintenance Mode & Coming Soon plugin to the latest available version at least 2.4.5...

WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF

The plugin is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack PoC...

CVE-2021-46781

The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-46781 Coming Soon by Supsystic < 1.7.6 - Reflected Cross-Site Scripting

The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting...

WordPress plugin Coming Soon by Supsystic 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Coming Soon by Supsystic plugin version 1.7.6 has a cross-site scripting vulnerability that...

IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some fields when high privilege users don't have the unfilteredhtml capability, which could lead to Stored Cross-Site Scripting issues PoC Customise a template from the plugin /wp-admin/admin.php?page=cscstemplates and put the following payload in the...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in Countdown,...

WordPress CMP - Coming Soon & Maintenance Plugin < 4.0.19 CSS Update Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Coming Soon Page and Maintenance Mode for WordPress Block Editor plugin <= 1.3.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Coming Soon Page and Maintenance Mode for WordPress Block Editor plugin versions = 1.3.1. Solution No patched version available...

WordPress Coming Soon Page and Maintenance Mode for WordPress Block Editor plugin <= 1.3.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Coming Soon Page and Maintenance Mode for WordPress Block Editor plugin versions = 1.3.1. Solution No patched version available...