Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Reflected Cross-Site Scripting (XSS)

The includes/mc-getlists.php file decoded JSON data fetched from the URL provided and then displayed the HTML from the response without any HTML escaping, leading to a reflected cross-site scripting issue where the payload is on a different server controlled by the attacker for example. The issue...

Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)

The includes/mc-getlists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue. The issue is exploitable via direct access to the affected file, and ucmmmcapi AJAX call available to both authenticated and...

WordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 1.1.1 - Server-Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability found by Mr.F in WordPress Under Construction, Coming Soon & Maintenance Mode plugin versions = 1.1.1. Solution Update the WordPress Under Construction, Coming Soon & Maintenance Mode plugin to the latest available version at least 1.1.2...

WordPress Coming Soon & Maintenance Mode Page plugin <= 1.57 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Coming Soon & Maintenance Mode Page plugin versions = 1.57. Solution Update the WordPress Coming Soon & Maintenance Mode Page plugin to the latest available version at least 1.58...

WordPress CMP – Coming Soon & Maintenance plugin <= 3.8.1 - Unauthenticated Subscribers List Export vulnerability

Unauthenticated Subscribers List Export vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin versions = 3.8.1. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version at least 3.8.2...

CVE-2020-15038

The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS...

CVE-2020-15038

CVE-2020-15038 affects the SeedProd WordPress plugin (Coming Soon Page/Maintenance Mode) up to version 5.1.1. The vulnerability is a stored XSS in the plugin’s page settings (e.g., headline field) that can trigger when the Coming Soon page is displayed. Multiple sources (NVD entry and OpenVAS/Exp...

PT-2020-14139 · Seedprod · Seedprod

Name of the Vulnerable Software and Affected Versions: SeedProd coming-soon plugin versions prior to 5.1.1 Description: The issue allows for XSS. Recommendations: For versions prior to 5.1.1, update to version 5.1.1 or later to resolve the issue...

Mozilla VPN – Firefox private network VPN is finally arriving

By Waqas Much-Awaited Mozilla VPN is on its way. This is a post from HackRead.com Read the original post: Mozilla VPN - Firefox private network VPN is finally arriving...

WordPress Minimal Coming Soon & Maintenance Mode Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Minimal Coming Soon & Maintenance Mode through 2.10 and earlie...

CVE-2020-6166

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes...

CVE-2020-6168

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting...

CVE-2020-6166

CVE-2020-6166 (WordPress Minimal Coming Soon & Maintenance Mode) affects the plugin versions up to 2.15. The flaw allows any authenticated user with at least basic access to export plugin settings or change the maintenance-page theme via insecure permissions. Technical details from connected sour...

CVE-2020-6167

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo...

CVE-2020-6167

The CVE-2020-6167 entry concerns WordPress plugin Minimal Coming Soon & Maintenance Mode (versions up to 2.10). The vulnerability is a CSRF to stored XSS and setting changes, permitted by a lack of nonce checks on settings endpoints, enabling an attacker to enable maintenance mode, inject XSS, mo...

VulnCheck KEV: CVE-2020-6166

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - Insecure Permissions: Enable and Disable Maintenance Mode vulnerability

Insecure Permissions: Enable and Disable Maintenance Mode vulnerability discovered by WordFence in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.15 - Insecure permissions: Export Settings/Theme Change vulnerability

Insecure permissions: Export Settings/Theme Change vulnerability found by Chloe Chamberland in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.15. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.17...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - CSRF to Stored XSS and Setting Changes vulnerability

CSRF to Stored XSS and Setting Changes vulnerability found by Chloe Chamberland in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

Policy Compliance Library Updates, November 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...