CVE-2020-15038: 
WordPress vulnerability analysis and mitigation

The SeedProd coming-soon plugin before version 5.1.1 for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-15038). The vulnerability was discovered on June 22, 2020, and affects the Coming Soon Page, Under Construction & Maintenance Mode plugin, which has over 1 million active installations (Astra Blog).

The vulnerability exists in the Headline field under the Page Settings section along with other fields in the plugin settings. The XSS payload gets triggered when the Coming Soon page is displayed, both in preview mode and live. The issue stems from insufficient data sanitization in plugin version 5.1.0 and below (Jinson Blog).

An attacker could exploit this vulnerability to perform various malicious actions, including stealing victims' session cookies or login credentials, performing arbitrary actions on victims' behalf, and logging keystrokes. Additionally, attackers could redirect users to malicious domains or create fake login forms to harvest credentials (Astra Blog).

The vulnerability requires an authenticated user with access to the plugin settings to exploit. When successfully exploited, the XSS payload would be triggered whenever the maintenance mode or coming soon page is displayed to visitors (Jinson Blog).

Users should update to plugin version 5.1.2 or later, which was released on June 24, 2020, with improved data sanitization to fix the vulnerability (Astra Blog).