CVE-2021-36845

YITH Maintenance Mode (WordPress plugin) versiyonları <= 1.3.8 içerisinde birden fazla Kimliği Doğrulanmış Depolanan Siteler Arası Betik Çalıştırma (XSS) zafiyeti bulunmaktadır; satıcının 1.3.7 versiyonunu 1.3.8'e yamalarken gözden kaçırdığı 46 adet savunmasız parametre mevcuttur. Savunmasız parametreler: 1 - "Newsletter" sekmesi, &yith_maintenance_newsletter_submit_label parametresi: bağlamı kırmak için yük (payload) tek tırnak (') sembolü ile başlamalıdır, örneğin: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - bu yük, yönetici bu sayfayı/sekmeyi ziyaret ettiğinde otomatik olarak tetiklenecektir. 2 - "General" sekmesi sorunları, savunmasız parametreler: &yith_maintenance_message, &yith_maintenance_custom_style, &yith_maintenance_mascotte, &yith_maintenance_title_font[size], &yith_maintenance_title_font[family], &yith_maintenance_title_font[color], &yith_maintenance_paragraph_font[size], &yith_maintenance_paragraph_font[family], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" sekmesi sorunları, savunmasız parametreler: &yith_maintenance_background_image, &yith_maintenance_background_color. 4 - "Logo" sekmesi sorunları, savunmasız parametreler: &yith_maintenance_logo_image, &yith_maintenance_logo_tagline, &yith_maintenance_logo_tagline_font[size], &yith_maintenance_logo_tagline_font[family], &yith_maintenance_logo_tagline_font[color]. 5 - "Newsletter" sekmesi sorunları, savunmasız parametreler: &yith_maintenance_newsletter_email_font[size], &yith_maintenance_newsletter_email_font[family], &yith_maintenance_newsletter_email_font[color], &yith_maintenance_newsletter_submit_font[size], &yith_maintenance_newsletter_submit_font[family], &yith_maintenance_newsletter_submit_font[color], &yith_maintenance_newsletter_submit_background, &yith_maintenance_newsletter_submit_background_hover, &yith_maintenance_newsletter_title, &yith_maintenance_newsletter_action, &yith_maintenance_newsletter_email_label, &yith_maintenance_newsletter_email_name, &yith_maintenance_newsletter_submit_label, &yith_maintenance_newsletter_hidden_fields. 6 - "Socials" sekmesi sorunları, savunmasız parametreler: &yith_maintenance_socials_facebook, &yith_maintenance_socials_twitter, &yith_maintenance_socials_gplus, &yith_maintenance_socials_youtube, &yith_maintenance_socials_rss, &yith_maintenance_socials_skype, &yith_maintenance_socials_email, &yith_maintenance_socials_behance, &yith_maintenance_socials_dribble, &yith_maintenance_socials_flickr, &yith_maintenance_socials_instagram, &yith_maintenance_socials_pinterest, &yith_maintenance_socials_tumblr, &yith_maintenance_socials_linkedin.