Coming Soon and Maintenance Mode < 3.5.3 – Authenticated Stored XSS | CVE 2021-24577 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.

Proof of Concept

* Open the Coming Soon plugin's settings (Coming Soon -> Coming Soon) 
* Click on the "Title" section
* Inject XSS payload into the Title section's "Title" form field. 
<!'/*"/*/'/*/"/*--></Script><Image SrcSet=K */; OnError=confirm`123` //>
* Click "Save Section", then reload the settings page (Coming Soon -> Coming Soon)

Affects Plugins

coming-soon-page

Fixed in 3.5.3

References

CVE

URL

https://www.hackpertise.com/cve/16-cve-2021-24577/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

d453b547-41a8-4a6b-8349-8686b7054805

Timeline

Publicly Published

2021-09-13 (about 4 years ago)

Added

2021-09-13 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2024-11-08

Title

Icon Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-08

Title

Contact Form 7 – PayPal & Stripe Add-on < 2.3.1 - Reflected Cross-Site Scripting

Published

2015-08-10

Title

Email Encoder Bundle <= 1.4.1 - Unauthenticated Cross-Site Scripting (XSS)

Published

2023-05-25

Title

Mocho Blog <= 1.0.4 - Reflected XSS

Published

2025-02-21

Title

List Urls <= 0.2 - Reflected Cross-Site Scripting