Wp Maintenance Mode Vulnerabilities

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track...

CVSS:

5.3

Affected:

up to 2.6.9

Fixed in:

2.6.10

Disclosed:

Feb 1, 2024

CVE-2024-1047 on NVD →

[en] The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with sub...

Affected:

up to 2.6.9

Fixed in:

2.6.9

Disclosed:

Jan 11, 2024

CVE-2023-7019 on NVD →

The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscrib...

CVSS:

4.3

Affected:

up to 2.6.8

Fixed in:

2.6.9

Disclosed:

Jan 5, 2024

CVE-2023-7019 on NVD →

[en] The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

Affected:

up to 2.4.5

Fixed in:

2.4.5

Disclosed:

Jul 11, 2022

CVE-2022-1576 on NVD →

The WP Maintenance Mode & Coming Soon plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.4. This is due to missing nonce validation on the reset_plugin_settings, subscribers_empty_list, dismiss_notices, subscribers_export, add_subscriber, & send_contact functions. Thi...

CVSS:

8.8

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Jun 20, 2022

CVE-2022-1576 on NVD →

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.

CVSS:

9.1

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Dec 14, 2018

CVE-2018-20156 on NVD →

[en] The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Dec 14, 2018

CVE-2018-20156 on NVD →

[en] The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Dec 14, 2018

CVE-2018-20155 on NVD →

[en] The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Dec 14, 2018

CVE-2018-20154 on NVD →

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.

CVSS:

5.4

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Jul 6, 2016

CVE-2018-20155 on NVD →

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.

CVSS:

4.3

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Jul 6, 2016

CVE-2018-20154 on NVD →

[en] Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

Affected:

up to 1.8.8

Fixed in:

1.8.8

Disclosed:

Jun 21, 2013

CVE-2013-3250 on NVD →

Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings.

CVSS:

5.4

Affected:

up to 1.8.8

Fixed in:

1.8.8

Disclosed:

Jun 5, 2013

CVE-2013-3250 on NVD →