Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS

2021-09-1300:00:00

Asif Nawaz Minhas

313

0.001 Low

EPSS

Percentile

25.0%

JSON

The plugin does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.

* Open the Coming Soon plugin's settings (Coming Soon -> Coming Soon) 
* Click on the "Title" section
* Inject XSS payload into the Title section's "Title" form field. 
<!'/*"/*/'/*/"/*--></Script><Image SrcSet=K */; OnError=confirm`123` //>
* Click "Save Section", then reload the settings page (Coming Soon -> Coming Soon)

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for WPEX-ID:D453B547-41A8-4A6B-8349-8686B7054805