WordPress Plugin Vulnerabilities

Minimal Coming Soon – Coming Soon Page < 2.35 - Multiple Authenticated Stored XSS

Description

The plugin does not sanitize or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them, which will be triggered in the backend.
A

Proof of Concept

Affects Plugins

Plugin icon
minimal-coming-soon-maintenance-mode
Fixed in 2.35

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
2.4 (low)

Miscellaneous

Verified
Yes
WPVDB ID
5f1dd9ad-dd2d-4d8f-903d-229a1163105d

Timeline

Publicly Published
2022-05-23 (about 3 years ago)
Added
2022-05-23 (about 3 years ago)
Last Updated
2022-05-23 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
Events Manager Extended - Stored XSS
Published
2025-02-24
Title
Private Content <= 8.11.5 - Reflected Cross-Site Scripting
Published
2023-03-22
Title
I Recommend This < 3.9.1 - CSRF
Published
2024-04-15
Title
Access Category Password <= 1.5.1 - Reflected Cross-Site Scripting
Published
2024-03-29
Title
Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget