Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: wpshopmart Clear all filters
TI-2024-01053 CVE-2024-1136 · GHSA-ph3h-5mmq-2rgv

Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass

Priority LOW 30

The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wpsm_coming_soon_redirect function in all versions up to, and in…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00465 Published 2024-02-28 No fix listed CWE-862
TI-2019-15243 CVE-2019-25140 · GHSA-g7hh-645p-7qhc

Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting

Priority LOW 39

The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo_height, rcsp_logo_url, home_sec_link_txt, rcsp_headline and rcsp_description pa…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00766 Published 2023-06-07 Fixed in 1.8.2 CWE-79
TI-2019-15242 CVE-2019-25139 · GHSA-9rpp-j343-49jh

Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset

Priority LOW 36

The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00814 Published 2023-06-07 No fix listed CWE-862
TI-2022-01182 CVE-2022-1298 · GHSA-9j4w-mccp-p9wv

Tabs Responsive < 2.2.8 - Editor+ Stored Cross-Site Scripting

Priority LOW 23

The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-23 Fixed in 2.2.8 CWE-79
TI-2021-06881 CVE-2021-24598 · GHSA-j7p6-w474-4fr8

Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00676 Published 2021-11-17 Fixed in 1.6.0 CWE-79
TI-2021-06483 CVE-2021-24191 · GHSA-cpf3-gq5c-48p5

WP Maintenance Mode & Site Under Construction < 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User

Priority MEDIUM 41

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific versi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01311 Published 2021-05-14 Fixed in 1.8.2 CWE-285