CVE-2022-1593

Published: Jun 27, 2022Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack

Affected (1)

Products: Site Offline Or Coming Soon Project: Site Offline Or Coming Soon

Site Offline Or Coming Soon Project

1 product

Site Offline Or Coming Soon

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Site Offline Or Coming Soon Project Site Offline Or Coming Soon	Up to 1.6.6

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.