Coming Soon Vulnerabilities

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `seedprodnestedmenuwidget` shortcode in all versions up to, and including, 6.20.2 due to insufficient input sanitization and output...

CVSS:

6.4

Affected:

up to 6.20.2

Fixed in:

6.20.3

Disclosed:

Jul 7, 2026

CVE-2025-14785 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.19.8. This makes it possible for authenticated attackers, with Editor-level access and above, to make web re...

CVSS:

5.5

Affected:

up to 6.19.8

Fixed in:

6.19.9

Disclosed:

Mar 14, 2026

CVE-2026-39464 on NVD →

[en] Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.7.

Affected:

up to 6.19.7

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-27368 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.19.8. This makes it possible for unauthenticated attackers to perform an...

CVSS:

5.3

Affected:

up to 6.19.8

Fixed in:

6.19.9

Disclosed:

Dec 24, 2025

CVE-2026-27368 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possib...

CVSS:

4.3

Affected:

up to 6.18.15

Fixed in:

6.18.16

Disclosed:

May 8, 2025

CVE-2025-3949 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd allows Cross Site Request Forgery. This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.18.9.

Affected:

up to 6.18.10

Fixed in:

6.18.10

Disclosed:

Jan 27, 2025

CVE-2025-24540 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.18.9. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for...

CVSS:

4.3

Affected:

up to 6.18.9

Fixed in:

6.18.10

Disclosed:

Nov 9, 2024

CVE-2025-24540 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.17.4...

Affected:

up to 6.18.4

Fixed in:

6.18.4

Disclosed:

Oct 6, 2024

CVE-2024-47299 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.17.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at...

CVSS:

4.4

Affected:

up to 6.17.4

Fixed in:

6.18.4

Disclosed:

Sep 24, 2024

CVE-2024-47299 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.15.20.

Affected:

up to 6.15.21

Fixed in:

6.15.21

Disclosed:

Apr 15, 2024

CVE-2024-32088 on NVD →

The Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.20. This is due to missing or incorrect nonce validation on the seedprod_lite_redirect_to_site() function. This makes it possible for unauthenti...

CVSS:

4.3

Affected:

up to 6.15.20

Fixed in:

6.15.21

Disclosed:

Apr 11, 2024

CVE-2024-32088 on NVD →

[en] The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it po...

Affected:

up to 6.15.22

Fixed in:

6.15.22

Disclosed:

Feb 5, 2024

CVE-2024-1072 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possibl...

CVSS:

8.2

Affected:

up to 6.15.21

Fixed in:

6.15.22

Disclosed:

Jan 31, 2024

CVE-2024-1072 on NVD →

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possibl...

Affected:

up to 6.15.22

Fixed in:

6.15.22

Disclosed:

Jan 31, 2024

[en] The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe conn...

Affected:

up to 6.15.15.3

Fixed in:

6.15.15.3

Disclosed:

Oct 20, 2023

CVE-2023-4975 on NVD →

The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect t...

CVSS:

4.3

Affected:

up to 6.15.13.1

Fixed in:

6.15.15.3

Disclosed:

Sep 18, 2023

CVE-2023-4975 on NVD →

The SeedProd Coming Soon plugin before 5.1.2 for WordPress allows XSS.

CVSS:

6.4

Affected:

up to 5.1.2

Fixed in:

5.1.2

Disclosed:

Jun 25, 2020

CVE-2020-15038 on NVD →

[en] The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.

Affected:

up to 5.1.2

Fixed in:

5.1.2

Disclosed:

Jun 24, 2020

CVE-2020-15038 on NVD →

Update the WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin to the latest available version (at least 6.15.22). Lucio Sá discovered and reported this Broken Access Control vulnerability in WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd Plugin. A broken...

Affected:

up to 6.15.22

Fixed in:

6.15.22

Affected:

up to 6.18.16

Fixed in:

6.18.16

CVE-2025-3949 on NVD →