6.9 Medium

CVE-2021-36841 Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin)…

Description

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.

Affected products and versions

Product	Affected versions	Fixed in
YITH Maintenance Mode (WordPress plugin) 1.3	earliest → 1.3.7	No fix stated

The 2 CVEs of YITH Maintenance Mode (WordPress plugin) →

CVE-2021-36845 Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin)… 6.9 Medium

Do you use YITH Maintenance Mode (WordPress plugin)?

Track this CVE Watch YITH Maintenance Mode (WordPress plugin) Check my SBOMs

www.cveye.io/en/cve/CVE-2021-36841

Timeline

Published September 27, 2021
Last modified April 28, 2026

References

wordpress.org wordpress.org
patchstack.com patchstack.com

Track this CVE

CVE-2021-36841 Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin)…

Description

Affected products and versions

Other CVEs of YITH Maintenance Mode (WordPress plugin)