WordPress plugin
Coming soon and Maintenance mode security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium3
- Low0
All Coming soon and Maintenance mode vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | IP Address Spoofing via get_real_ip ≤3.7.3Update to 3.7.4 | CVE-2023-49741 | |
| Medium4.3 | Missing Authorization to Arbitrary Email Send ≤3.6.6Update to 3.6.7 | CVE-2022-0164 | |
| High8.8 | Cross-Site request Forgery to Arbitrary Email Send <3.6.8Update to 3.6.8 | CVE-2022-0199 | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting <3.5.3Update to 3.5.3 | CVE-2021-24577 |
- Medium5.3IP Address Spoofing via get_real_ip
≤3.7.3Update to 3.7.4
- Medium4.3Missing Authorization to Arbitrary Email Send
≤3.6.6Update to 3.6.7
- High8.8Cross-Site request Forgery to Arbitrary Email Send
<3.6.8Update to 3.6.8
- Medium6.4Authenticated Stored Cross-Site Scripting
<3.5.3Update to 3.5.3
Coming soon and Maintenance mode: common questions
Does Coming soon and Maintenance mode have known vulnerabilities?
Yes. VulnCrest Radar lists 4 known vulnerabilities in Coming soon and Maintenance mode: 1 high, 3 medium. None are known to affect version null.
How do I check which version of Coming soon and Maintenance mode I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Coming soon and Maintenance mode vulnerability?
CVE-2023-49741, published Dec 1, 2023: Coming soon and Maintenance mode <= 3.7.3 - IP Address Spoofing via get_real_ip. Severity: Medium (CVSS 5.3).
Is any Coming soon and Maintenance mode vulnerability listed in CISA KEV?
No. None of the known Coming soon and Maintenance mode vulnerabilities is currently listed in the CISA KEV catalog.