Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
Why it matters now
EPSS 0.0062 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Coming soon and Maintenance mode (Unknown): 3.5.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Coming soon and Maintenance mode | 3.5.3 to before 3.5.3 | 3.5.3 | Patch available | CNA |
- Coming soon and Maintenance mode VendorUnknown Affected 3.5.3 to before 3.5.3 Fixed in 3.5.3 Patch available CNA
Remediation
- Fix · CNA Coming soon and Maintenance mode (Unknown) Fixed in 3.5.3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24577
- 2026-10-03 Alias added: GHSA-32hf-ffvm-wx32
References
More wpdevart Coming Soon And Maintenance Mode vulnerabilities
- TI-2022-00137 Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF CVSS 3.1MEDIUM 4.3
- TI-2022-00105 Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-24577 · CVE Program
- CVE-2021-24577 · NVD
- FIRST EPSS
- GHSA-32hf-ffvm-wx32 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences