WordPress Plugin Vulnerabilities

Under Construction / Maintenance Mode from Acurax <= 2.6 - Unauthenticated Stored XSS

Description

The plugin does not validate and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
coming-soon-maintenance-mode-from-acurax
No known fix

References

CVE
CVE-2023-39926

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Robert DeVore
Verified
No
WPVDB ID
c16d5caa-6a6c-44be-a334-87c1f4e54590

Timeline

Publicly Published
2023-11-07 (about 2 years ago)
Added
2023-11-17 (about 2 years ago)
Last Updated
2023-11-17 (about 2 years ago)

Other

Published
Title
Published
2025-07-17
Title
Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) <= 1.2 - Reflected Cross-Site Scripting
Published
2024-04-24
Title
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) < 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget
Published
2017-11-22
Title
Customer Area < 7.4.3 - XSS
Published
2014-12-27
Title
Frontend Uploader < 0.9.4 - Unauthenticated Cross-Site Scripting (XSS)
Published
2026-02-13
Title
WP Data Access < 5.5.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode