plugin
7 known security issues reported for the Curtain WordPress plugin. Most recent disclosed May 23, 2022.
Running Curtain on your site? Check whether your installed version is affected.
Scan your site free[en] The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Stored Cross-Site Scripting (XSS) vulnerability was discovered by Hassan Khan Yusufzai (Splint3r7) in the WordPress Curtain plugin (versions <= 1.0.2).
The Curtain plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.0.1 due to insufficient capability and nonce checking on the admin_init function. This makes it possible for unauthenticated users to arbitrarily enable and disable maintenance mode on a vulnerable site.
Unauthenticated Maintenance Mode Switch vulnerability discovered by Hassan Khan Yusufzai (Splint3r7) in WordPress Curtain plugin (versions <= 1.0.1).
The Curtain plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.0.1 due to insufficient capability and nonce checking on the admin_init function. This makes it possible for unauthenticated users to arbitrarily enable and disable maintenance mode on a vulnerable site.
The plugin does not have authorisation and CSRF checks in place when switching maintenance modes, which could allow unauthenticated attackers change maintenance modes
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free