CVE-2020-6168

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting...

Cross site scripting

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting...

Design/Logic Flaw

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes...

CVE-2020-6168

CVE-2020-6168 – WordPress Minimal Coming Soon & Maintenance Mode : The vulnerability affects the plugin up to version 2.10, allowing any authenticated user with subscriber permissions or higher to enable/disable Maintenance Mode via crafted requests (e.g., /wp-admin/admin.php?action=csmm_change_s...

CVE-2020-6168

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting...

CVE-2020-6166

CVE-2020-6166 (WordPress Minimal Coming Soon & Maintenance Mode) affects the plugin versions up to 2.15. The flaw allows any authenticated user with at least basic access to export plugin settings or change the maintenance-page theme via insecure permissions. Technical details from connected sour...

CVE-2020-6167

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo...

CVE-2020-6167

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo...

Cross site request forgery (csrf)

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo...

CVE-2020-6167

The CVE-2020-6167 entry concerns WordPress plugin Minimal Coming Soon & Maintenance Mode (versions up to 2.10). The vulnerability is a CSRF to stored XSS and setting changes, permitted by a lack of nonce checks on settings endpoints, enabling an attacker to enable maintenance mode, inject XSS, mo...

Minimal Coming Soon & Maintenance Mode < 2.15 - Insecure Permissions: Enable and Disable Maintenance Mode

There was a flaw that allowed any authenticated user with subscriber permissions or above the ability to enable and disable maintenance mode on a vulnerable site by sending a simple request. PoC Login as a user with subscriber or above permissions and send the following request to enable...

VulnCheck KEV: CVE-2020-6166

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes...

Minimal Coming Soon & Maintenance Mode < 2.15 - Insecure Permissions: Enable and Disable Maintenance Mode

There was a flaw that allowed any authenticated user with subscriber permissions or above the ability to enable and disable maintenance mode on a vulnerable site by sending a simple request. Login as a user with subscriber or above permissions and send the following request to enable maintenance...

Minimal Coming Soon & Maintenance Mode < 2.15 - CSRF to Stored XSS and Setting Changes

This plugin had no nonce checks on any of the settings to verify that a request came from a legitimate source, such as a logged in administrative user. Therefore, creating a CSRF to stored XSS in addition to significant setting changes. alert1" /...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.15 - Insecure permissions: Export Settings/Theme Change vulnerability

Insecure permissions: Export Settings/Theme Change vulnerability found by Chloe Chamberland in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.15. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.17...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - CSRF to Stored XSS and Setting Changes vulnerability

CSRF to Stored XSS and Setting Changes vulnerability found by Chloe Chamberland in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

WordPress Minimal Coming Soon & Maintenance Mode plugin <= 2.10 - Insecure Permissions: Enable and Disable Maintenance Mode vulnerability

Insecure Permissions: Enable and Disable Maintenance Mode vulnerability discovered by WordFence in WordPress Minimal Coming Soon & Maintenance Mode plugin versions = 2.10. Solution Update the WordPress Minimal Coming Soon & Maintenance Mode plugin to the latest available version at least 2.15...

WordPress WP Maintenance Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up personal blog sites.WP Maintenance is used in one of the site maintenance page settings plugin. A cross-site request forgery vulnerability exist...

CVE-2019-19979

A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS...

WordPress IgniteUp Arbitrary File Deletion Vulnerability

The WordPress plugin IgniteUp is used to create "Coming Soon" and "Maintenance" mode pages. An arbitrary file deletion vulnerability exists in includes/class-coming-soon-creator.php in IgniteUp 3.4 and earlier versions. An attacker can exploit this vulnerability to delete arbitrary files...