CVE-2015-9429: wordpress yith-maintenance-mode Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2015-9429 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in wordpress yith-maintenance-mode. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.3% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 1.2.0.
Timeline
- 26-09-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.87%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.87% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (wpvulndb.com)
Maturity: unknown
Exploit Reference (cinu.pl)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Wordpress1 product
- yith-maintenance-mode≤ 1.1.4 (fixed in 1.2.0)
Yithemes1 product
- yith_maintenance_mode< 1.2.0
2 vendors · 2 products
References
4 links- cinu.pl/research/wp-plugins/mail_3a14a77571c73684103e0f517a92d757.htmlX Refsource MISCExploitThird Party Advisory