Threat Entry Updated 2025-05-12

CVE-2025-3949 - Coming Soon Plugin

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.

PLUGIN Coming Soon

CVE-2025-3949

MEDIUM CVSS 4.3 2025-05-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-4975 - Coming Soon Plugin

The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Coming Soon

CVE-2023-4975

MEDIUM CVSS 4.3 2023-10-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1322 - Coming Soon Plugin

The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

PLUGIN Coming Soon

CVE-2022-1322

MEDIUM CVSS 4.8 2022-08-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1576 - Coming Soon Plugin

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack

PLUGIN Coming Soon

CVE-2022-1576

MEDIUM CVSS 6.5 2022-07-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-46781 - Coming Soon Plugin

The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting

PLUGIN Coming Soon

CVE-2021-46781

MEDIUM CVSS 6.1 2022-04-25

Risk Score

Open Full Technical Breakdown