The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 30 Oct 2025 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |
| Title | NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSS | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2025-10-30T06:00:07.969Z
Reserved: 2025-09-17T13:29:16.380Z
Link: CVE-2025-10636
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-30T06:15:43.577
Modified: 2025-10-30T06:15:43.577
Link: CVE-2025-10636
Redhat
No data.
OpenCVE Enrichment
No data.