CVE-2022-1593: 
WordPress vulnerability analysis and mitigation

The Site Offline or Coming Soon WordPress plugin version 1.6.6 and below contains a Stored Cross-Site Scripting vulnerability via CSRF (CVE-2022-1593). The vulnerability was discovered by Daniel Ruf and publicly disclosed on June 6, 2022. The issue affects the site-is-offline-plugin and currently has no known fix (WPScan).

The vulnerability stems from the plugin's lack of CSRF protection when updating settings, combined with insufficient sanitization and escaping mechanisms. The issue has been assigned a CVSS score of 6.1 (medium severity) and is classified under CWE-352 (Cross-Site Request Forgery). The vulnerability allows attackers to execute Cross-Site Scripting payloads through CSRF attacks targeting logged-in administrators (WPScan).

When successfully exploited, attackers can manipulate plugin settings and inject malicious Cross-Site Scripting payloads through CSRF attacks. This allows them to execute arbitrary JavaScript code in the context of authenticated administrators' sessions (WPScan).

As there is no known fix available for this vulnerability, administrators should consider either disabling the plugin or implementing additional security controls such as Web Application Firewalls (WAF) to prevent CSRF attacks (WPScan).