CVE-2019-25140 in WordPress Coming Soon Page & Maintenance Mode Plugin
Summary
by MITRE • 06/07/2023
The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo_height, rcsp_logo_url, home_sec_link_txt, rcsp_headline and rcsp_description parameters in versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2019-25140 affects the WordPress Coming Soon Page & Maintenance Mode plugin, which is widely used to display maintenance pages and coming soon notifications on WordPress websites. This plugin serves as a critical component for website administrators to manage user access during site maintenance or launch phases, making it a prime target for attackers seeking to exploit web application vulnerabilities. The issue resides in version 1.8.1 and earlier releases, where the plugin fails to properly sanitize user input across multiple parameters that are used to configure the maintenance page appearance and functionality.
The technical flaw manifests through insufficient input sanitization and output escaping mechanisms within the plugin's codebase. Attackers can exploit this vulnerability by injecting malicious JavaScript code through the logo_width, logo_height, rcsp_logo_url, home_sec_link_txt, rcsp_headline, and rcsp_description parameters. These parameters are typically used to customize the visual elements and content of the maintenance page, but they do not properly validate or escape user-supplied data before rendering it on the web page. This creates a stored cross-site scripting vulnerability where malicious code persists in the database and executes whenever any user accesses the affected page.
The operational impact of this vulnerability is significant as it allows unauthenticated attackers to execute arbitrary web scripts in the context of any user who visits the compromised maintenance page. This means that when legitimate users access the maintenance page, their browsers will execute the injected malicious code, potentially leading to session hijacking, credential theft, or redirection to malicious websites. The vulnerability affects all users who encounter the maintenance page, regardless of their authentication status, making it particularly dangerous for websites that use the plugin to display public maintenance messages. The stored nature of the XSS vulnerability means that the malicious code remains persistent until manually removed from the database, providing attackers with extended opportunities to exploit victims.
This vulnerability aligns with CWE-79, which defines Cross-Site Scripting as a common weakness in web applications where user-provided data is not properly sanitized before being rendered in web pages. The ATT&CK framework categorizes this as a technique for code injection, specifically targeting the web application layer where user input is processed. The lack of proper input validation and output escaping demonstrates a failure in the principle of least privilege and defense in depth, as the plugin does not implement proper security controls to prevent malicious data from being executed. Organizations using this plugin should immediately update to a patched version, as the vulnerability can be exploited without any authentication requirements, making it accessible to anyone who can submit data to the affected parameters. The security implications extend beyond simple script execution, as attackers could potentially leverage this vulnerability to establish persistent access to user sessions or redirect traffic to phishing sites.