Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

188 results · page 3 of 4

Aug 13, 2024Coming Soon: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38756 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming Soon: from n/a through 1.6.3.
Product
Coming Soon
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2024Hummingbird: Missing AuthorizationCVE-2024-32792 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.7.3.
Product
Hummingbird
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Minimal Coming Soon – Coming Soon Page: Unauthorized modification of dataCVE-2024-5087 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.
Product
Minimal Coming Soon – Coming Soon Page
Affected
up to 2.38
What to do
Affects up to 2.38. Update Minimal Coming Soon – Coming Soon Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 5, 2024Countdown, Coming Soon, Maintenance – Countdown & Clock: Unauthorized accessCVE-2024-2017 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns.
Product
Countdown, Coming Soon, Maintenance – Countdown & Clock
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Countdown, Coming Soon, Maintenance – Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Coming soon and Maintenance mode: Authentication Bypass by SpoofingCVE-2023-49741 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.
Product
Coming soon and Maintenance mode
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update Coming soon and Maintenance mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 30, 2024Event Monster – Event Management, Tickets Booking, Upcoming Event: PHP Object InjectionCVE-2024-1895 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.9 via deserialization via shortcode of untrusted input from a custom meta value. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2024Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Cross-Site Request Forgery (CSRF)CVE-2024-32088 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.15.20.
Product
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
Affected
up to 6.15.20
What to do
Affects up to 6.15.20. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2024VideoWhisper Live Streaming Integration: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2023-25699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.
Product
VideoWhisper Live Streaming Integration
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024CMP – Coming Soon & Maintenance: Server-Side Request Forgery (SSRF)CVE-2023-50374 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.10
What to do
Affects up to 4.1.10. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Coming Soon & Maintenance Mode by Colorlib: Information ExposureCVE-2024-1473 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mode protection provided by the plugin.
Product
Coming Soon & Maintenance Mode by Colorlib
Affected
up to 1.0.99
What to do
Affects up to 1.0.99. Update Coming Soon & Maintenance Mode by Colorlib to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 20, 2024Coming Soon, Under Construction & Maintenance Mode By Dazzler: Maintenance mode bypassCVE-2024-1181 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUEST_URI to determine if the page being accesses is an admin area. This makes it possible for unauthenticated attackers to bypass maintenance mode and access the site which may be considered confidential when in maintenance mode.
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages: Stored Cross-Site ScriptingCVE-2023-6880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 45.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages
Affected
up to 45.6.0
What to do
Affects up to 45.6.0. Update Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record help.visualcomposer.com wordfence.com
Feb 28, 2024Coming Soon Maintenance Mode: Sensitive Information ExposureCVE-2024-1475 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content thus bypassing the protection provided by the plugin.
Product
Coming Soon Maintenance Mode
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Coming Soon Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Advanced Flamingo: Cross-Site Request Forgery (CSRF)CVE-2023-52226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
Product
Advanced Flamingo
Affected
up to 1.0
What to do
Affects up to 1.0. Update Advanced Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Coming Soon Page & Maintenance Mode: Unauthorized access of dataCVE-2024-1136 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wpsm_coming_soon_redirect function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to view a site with maintenance mode or coming-soon mode enabled to view the site's content.
Product
Coming Soon Page & Maintenance Mode
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 15, 2024Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages: Sensitive Information ExposureCVE-2024-0708 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers to access landing pages that may not be public.
Product
Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2024KD Coming Soon: Deserialization of Untrusted DataCVE-2023-46615 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.
Product
KD Coming Soon
Affected
up to 1.7
What to do
Affects up to 1.7. Update KD Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Minimal Coming Soon – Coming Soon Page: Maintenance mode bypass and information disclosureCVE-2024-1075 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request path. This makes it possible for unauthenticated attackers to bypass maintenance mode and view pages that should be hidden.
Product
Minimal Coming Soon – Coming Soon Page
Affected
up to 2.37
What to do
Affects up to 2.37. Update Minimal Coming Soon – Coming Soon Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode: Unauthorized modification of dataCVE-2024-1072 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.
Product
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
Affected
up to 6.15.21
What to do
Affects up to 6.15.21. Update Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024LightStart – Maintenance Mode, Coming Soon and Landing Page Builder: Unauthorized modification of dataCVE-2023-7019 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.
Product
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update LightStart – Maintenance Mode, Coming Soon and Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2023Event Monster – Event Management, Tickets Booking, Upcoming Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Site Offline Or Coming Soon Or Maintenance Mode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49190 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandra Shekhar Sahu Site Offline Or Coming Soon Or Maintenance Mode allows Stored XSS.This issue affects Site Offline Or Coming Soon Or Maintenance Mode: from n/a through 1.5.6.
Product
Site Offline Or Coming Soon Or Maintenance Mode
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Site Offline Or Coming Soon Or Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Rocket Maintenance Mode & Coming Soon Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49842 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This issue affects Rocket Maintenance Mode & Coming Soon Page: from n/a through 4.3.
Product
Rocket Maintenance Mode & Coming Soon Page
Affected
up to 4.3
What to do
Affects up to 4.3. Update Rocket Maintenance Mode & Coming Soon Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Coming Soon Page – Responsive Coming Soon & Maintenance Mode: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-46849 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page – Responsive Coming Soon & Maintenance Mode allows SQL Injection.This issue affects Coming Soon Page – Responsive Coming Soon & Maintenance Mode: from n/a through 1.5.9.
Product
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Coming Soon Page – Responsive Coming Soon & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
Product
DoLogin Security
Fixed in
3.7
What to do
Update DoLogin Security to 3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2023Coming Soon & Maintenance Mode Page: Cross-Site Request ForgeryCVE-2020-36752 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save meta boxes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Coming Soon & Maintenance Mode Page
Affected
up to 1.57
What to do
Affects up to 1.57. Update Coming Soon & Maintenance Mode Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 19, 2023File Renaming on Upload: Does not sanitise and escape some of its settingsCVE-2023-2684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
File Renaming on Upload
Fixed in
2.5.2
What to do
Update File Renaming on Upload to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2023CMP – Coming Soon & Maintenance: Maintenance Mode BypassCVE-2023-2159 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023Coming Soon & Maintenance Mode Page: Cross-Site Request ForgeryCVE-2020-36707 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to confusing logic functions missing or having incorrect nonce validation. This makes it possible for unauthenticated attackers to gain and perform otherwise unauthorized access and actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Coming Soon & Maintenance Mode Page
Affected
up to 1.57
What to do
Affects up to 1.57. Update Coming Soon & Maintenance Mode Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jetpack.com wpscan.com
Jun 6, 2023WordPress Coming Soon Page & Maintenance Mode: Stored Cross-Site ScriptingCVE-2019-25140 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo_height, rcsp_logo_url, home_sec_link_txt, rcsp_headline and rcsp_description parameters in versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Coming Soon Page & Maintenance Mode
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update WordPress Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Coming Soon Page & Maintenance Mode: Unauthenticated settings resetCVE-2019-25139 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.
Product
Coming Soon Page & Maintenance Mode
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
Product
Otter
Fixed in
2.2.6
What to do
Update Otter to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions.CVE-2023-22714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions.
Affected
up to 1.7.10
What to do
Affects up to 1.7.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2023Hummingbird: Does not validate the generated file path for page cache files before writing themCVE-2023-1478 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path traversal vulnerability in the page cache module.
Product
Hummingbird
Fixed in
3.4.2
What to do
Update Hummingbird to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions.CVE-2022-46854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions.
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 7, 2023CMP – Coming Soon & Maintenance: Information ExposureCVE-2023-1263 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Product
Site Offline Or Coming Soon Or Maintenance Mode
Fixed in
1.5.3
What to do
Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress.CVE-2021-36829 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress.
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 22, 2022Coming Soon - Under Construction: Does not sanitize and escape some of its settingsCVE-2022-1322 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Coming Soon - Under Construction
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Coming Soon - Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022WP Maintenance Mode & Coming Soon: Is lacking CSRFCVE-2022-1576 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Product
WP Maintenance Mode & Coming Soon
Fixed in
2.4.5
What to do
Update WP Maintenance Mode & Coming Soon to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Site Offline or Coming Soon: Does not have CSRF check in placeCVE-2022-1593 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack
Product
Site Offline or Coming Soon
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Site Offline or Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Coming Soon & Maintenance Mode by Colorlib: Does not sanitize and escape some settingsCVE-2022-1945 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup)
Product
Coming Soon & Maintenance Mode by Colorlib
Fixed in
1.0.99
What to do
Update Coming Soon & Maintenance Mode by Colorlib to 1.0.99 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Coming Soon by Supsystic: Does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46781 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Coming Soon by Supsystic
Fixed in
1.7.6
What to do
Update Coming Soon by Supsystic to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Hummingbird: Does not sanitise and escape the Config NameCVE-2022-0994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Hummingbird
Fixed in
3.3.2
What to do
Update Hummingbird to 3.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Countdown, Coming Soon, Maintenance: Does not sanitize and escape the post parameter before outputting it back in an admin pageCVE-2022-0601 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Countdown, Coming Soon, Maintenance
Fixed in
2.2.9
What to do
Update Countdown, Coming Soon, Maintenance to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have CSRF check in its coming_soon_send_mail AJAX actionCVE-2022-0199 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
Product
Coming soon and Maintenance mode
Fixed in
3.6.8
What to do
Update Coming soon and Maintenance mode to 3.6.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX actionCVE-2022-0164 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
Product
Coming soon and Maintenance mode
Fixed in
3.5.3
What to do
Update Coming soon and Maintenance mode to 3.5.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022LiteSpeed Cache: Does not properly verify that requests are coming from QUICCVE-2021-24964 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
Product
LiteSpeed Cache
Fixed in
4.4.4
What to do
Update LiteSpeed Cache to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Coming Soon, Under Construction & Maintenance Mode By Dazzler: Does not sanitise or escape its description settingCVE-2021-24539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Fixed in
1.6.7
What to do
Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Coming soon and Maintenance mode: Does not properly sanitize inputs submitted by authenticated usersCVE-2021-24577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
Product
Coming soon and Maintenance mode
Fixed in
3.5.3
What to do
Update Coming soon and Maintenance mode to 3.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.