Yith Maintenance Mode Vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yith_maintenance_newsletter_s...

CVSS:

6.9

Affected:

up to 1.3.8

Fixed in:

1.4.0

Disclosed:

Sep 23, 2021

CVE-2021-36845 on NVD →

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.

CVSS:

6.9

Affected:

up to 1.3.7

Fixed in:

1.3.8

Disclosed:

Sep 15, 2021

CVE-2021-36841 on NVD →

The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.

CVSS:

6.1

Affected:

up to 1.1.4

Fixed in:

1.2.0

Disclosed:

Aug 2, 2015

CVE-2015-9429 on NVD →