Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yithmaintenancenewslettersubmitlabel parameter: payload should start with a single quote (') symbol to break the context, i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - "General" tab issues, vulnerable parameters: &yithmaintenancemessage, &yithmaintenancecustomstyle, &yithmaintenancemascotte, &yithmaintenancetitlefont[size], &yithmaintenancetitlefont[family], &yithmaintenancetitlefont[color], &yithmaintenanceparagraphfont[size], &yithmaintenanceparagraphfont[family], &yithmaintenanceparagraphfont[color], &yithmaintenancebordertop. 3 - "Background" tab issues, vulnerable parameters: &yithmaintenancebackgroundimage, &yithmaintenancebackgroundcolor. 4 - "Logo" tab issues, vulnerable parameters: &yithmaintenancelogoimage, &yithmaintenancelogotagline, &yithmaintenancelogotaglinefont[size], &yithmaintenancelogotaglinefont[family], &yithmaintenancelogotaglinefont[color]. 5 - "Newsletter" tab issues, vulnerable parameters: &yithmaintenancenewsletteremailfont[size], &yithmaintenancenewsletteremailfont[family], &yithmaintenancenewsletteremailfont[color], &yithmaintenancenewslettersubmitfont[size], &yithmaintenancenewslettersubmitfont[family], &yithmaintenancenewslettersubmitfont[color], &yithmaintenancenewslettersubmitbackground, &yithmaintenancenewslettersubmitbackgroundhover, &yithmaintenancenewslettertitle, &yithmaintenancenewsletteraction, &yithmaintenancenewsletteremaillabel, &yithmaintenancenewsletteremailname, &yithmaintenancenewslettersubmitlabel, &yithmaintenancenewsletterhiddenfields. 6 - "Socials" tab issues, vulnerable parameters: &yithmaintenancesocialsfacebook, &yithmaintenancesocialstwitter, &yithmaintenancesocialsgplus, &yithmaintenancesocialsyoutube, &yithmaintenancesocialsrss, &yithmaintenancesocialsskype, &yithmaintenancesocialsemail, &yithmaintenancesocialsbehance, &yithmaintenancesocialsdribble, &yithmaintenancesocialsflickr, &yithmaintenancesocialsinstagram, &yithmaintenancesocialspinterest, &yithmaintenancesocialstumblr, &yithmaintenancesocialslinkedin.

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yithmaintenancenewslettersubmitlabel. Possible even when unfiltered HTML is disallowed by WordPress configuration.

The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panelpage parameter.