Lucene search
Asif Nawaz MinhasWPVDB-ID:D453B547-41A8-4A6B-8349-8686B7054805HistorySep 13, 2021 - 12:00 a.m.
Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS
2021-09-1300:00:00
Asif Nawaz Minhas
wpscan.com
8
0.001 Low
EPSS
Percentile
25.0%
The plugin does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
PoC
- Open the Coming Soon plugin’s settings (Coming Soon -> Coming Soon) * Click on the “Title” section * Inject XSS payload into the Title section’s “Title” form field.
| CPE | Name | Operator | Version |
|---|---|---|---|
| coming-soon-page | lt | 3.5.3 |
Related
patchstack
patchstack
wpexploit
wpexploit
Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS
2021-09-13 00:00:00
cnvd
cnvd
prion
prion
Cross site scripting
2021-10-11 11:15:00
nvd
nvd
CVE-2021-24577
2021-10-11 11:15:08
cve
cve
CVE-2021-24577
2021-10-11 11:15:08
cvelist
cvelist