CVE-2021-24577: Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-11 · updated 2026-06-17
Weakness: CWE-79

Description

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.

Affected products

Coming soon and Maintenance mode: before 3.5.3 — fixed in 3.5.3

How to fix

Upgrade to a fixed version: Coming soon and Maintenance mode 3.5.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d453b547-41a8-4a6b-8349-8686b7054805
https://wpscan.com/vulnerability/d453b547-41a8-4a6b-8349-8686b7054805

Get alerted when CVE-2021-24577 or the next vulnerability affects your stack