Easy Coming Soon Vulnerabilities

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions.

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Sep 27, 2023

CVE-2023-25483 on NVD →

The Easy Coming Soon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitr...

CVSS:

4.4

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Aug 28, 2023

CVE-2023-25483 on NVD →

The Easy Coming Soon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_color' parameter in versions before 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute w...

CVSS:

7.4

Affected:

up to 1.8.2

Fixed in:

1.8.2

Disclosed:

Aug 24, 2015

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.8.2

Fixed in:

1.8.2

Disclosed:

Aug 24, 2015

The Easy Coming Soon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_color' parameter in versions before 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute w...

Affected:

up to 1.8.2

Fixed in:

1.8.2

Disclosed:

Aug 24, 2015

The Easy Coming Soon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘coming_soon_page_settings’ function in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 1.6.1

Fixed in:

1.6.3

Disclosed:

Mar 18, 2015

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 1.6.3

Fixed in:

1.6.3

Disclosed:

Mar 18, 2015

The Easy Coming Soon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘coming_soon_page_settings’ function in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pa...

Affected:

up to 1.6.3

Fixed in:

1.6.3

Disclosed:

Mar 18, 2015

Affected:

up to 1.8.2

Fixed in:

1.8.2

The AJAX function &lsquo;coming_soon_page_settings&rsquo;, defined in &lsquo;easy-coming-soon/coming-soon-plugin.php&rsquo; is available to any registered user. This allows any registered user of the site to enable, and update the settings in the &lsquo;Easy Coming Soon&rsquo; Plugin, to output any arbitrary HTML/JS co...

Affected:

up to 1.6.3

Fixed in:

1.6.3