ThemeGrill Vulnerabilities and Affected Products
Vulnerabilities associated with Maintenance Page.
Products
Clear product- ColorMag3 vulnerabilities
- Masteriyo - LMS3 vulnerabilities
- Himalayas2 vulnerabilities
- Maintenance Page2 vulnerabilities
- ThemeGrill Demo Importer2 vulnerabilities
- themegrill_demo_importer2 vulnerabilities
- User Registration2 vulnerabilities
- User Registration Stripe2 vulnerabilities
- Zakra2 vulnerabilities
- Accelerate1 vulnerability
- ColorNews1 vulnerability
- Esteem1 vulnerability
- maintenance_page1 vulnerability
- Registration Form for WooCommerce1 vulnerability
- Spacious1 vulnerability
- ThemeGrill Demo Importer plugin for WordPress1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-1462MEDIUM | Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST APIThe Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode. CWE-284Mar 13, 2024 | CVSS5.3v3.1 | EPSS0.53% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1370MEDIUM | Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information ExposureThe Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hooked via AJAX action in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with subscriber access or higher, to download a csv containing subscriber emails. | CVSS5.3v3.1 | EPSS0.445% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |