Hello,

Plugin: YITH Maintenance Mode 1.1.4 https://wordpress.org/plugins/yith-maintenance-mode/

1. Reflected Cross-Site Scripting (XSS)

Authenticated administrators can store html/js code (there is no CSRF protection).

Method: GET/POST

Url: http://localhost/wp-admin/themes.php?page=yith-maintenance-mode&panel_page=[xss]

Vulnerable parameters: panel_page

Example PHP callstack:

YITH_Panel::display_panel_page   [/yith-maintenance-mode/yit-common/yith-panel.php:163]

Verification: