CVE-2021-46781: Coming Soon by Supsystic < 1.7.6 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-25 · updated 2026-06-17
Weakness: CWE-79

Description

The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting

Affected products

Coming Soon by Supsystic: before 1.7.6 — fixed in 1.7.6

How to fix

Upgrade to a fixed version: Coming Soon by Supsystic 1.7.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/49589867-f764-4c4a-b640-84973c673b23
https://wpscan.com/vulnerability/49589867-f764-4c4a-b640-84973c673b23

Get alerted when CVE-2021-46781 or the next vulnerability affects your stack