Hello,

Plugin: Easy Pie Coming Soon 1.0.0 https://wordpress.org/plugins/easy-pie-coming-soon/

1. Cross-Site Scripting (XSS) 

Authenticated administrators can inject html/js code (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/admin.php?page=easy-pie-coming-soon&tab=[xss]

Vulnerable parameter: tab

Example PHP callstack:

/easy-pie-coming-soon/pages/page-options.php:33

Verification: