{"id":"CVE-2022-1593","state":"PUBLISHED","title":"Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF","description":"The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack","publishedAt":"2022-06-27T08:57:06.000Z","updatedAt":"2024-08-03T00:10:03.565Z","severity":null,"assigner":"WPScan","products":["Unknown Site Offline or Coming Soon"],"affected":[{"vendor":"Unknown","product":"Site Offline or Coming Soon","versions":[{"version":"1.6.6","status":"affected","lessThanOrEqual":"1.6.6","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:29.138Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/1xxx/CVE-2022-1593.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-1593","state":"PUBLISHED","datePublished":"2022-06-27T08:57:06.000Z","dateUpdated":"2024-08-03T00:10:03.565Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-05-05T00:00:00.000Z"},"containers":{"cna":{"title":"Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF","descriptions":[{"lang":"en","value":"The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack"}],"affected":[{"vendor":"Unknown","product":"Site Offline or Coming Soon","versions":[{"version":"1.6.6","status":"affected","lessThanOrEqual":"1.6.6","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-06-27T08:57:06.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Daniel Ruf"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2022-1593","STATE":"PUBLIC","TITLE":"Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Site Offline or Coming Soon","version":{"version_data":[{"version_affected":"<=","version_name":"1.6.6","version_value":"1.6.6"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Daniel Ruf"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185","refsource":"MISC","url":"https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/67678666-402b-4010-ac56-7067a0f40185","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T00:10:03.565Z"}}]}}}