WordPress Plugin Vulnerabilities

YITH Maintenance Mode < 1.3.8 - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise the yith_maintenance_newsletter_submit_label settings, which could allow high privilege users to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
yith-maintenance-mode
Fixed in 1.3.8

References

CVE
CVE-2021-36841

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Verified
No
WPVDB ID
fcf4ab57-9dc7-4f25-9abf-0c6f15fe8b4e

Timeline

Publicly Published
2021-09-15 (about 4 years ago)
Added
2021-09-27 (about 4 years ago)
Last Updated
2022-04-12 (about 4 years ago)

Other

Published
Title
Published
2024-04-29
Title
CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-09-24
Title
Elementor Addons by Livemesh < 8.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter
Published
2024-03-13
Title
WPFunnels < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-02-13
Title
Email Encoder – Protect Email Addresses and Phone Numbers < 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2021-01-29
Title
Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)