WP Maintenance

WP Maintenance has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2025; all 7 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (29%). Other recurring categories include Use Of Less Trusted Source, Cross-Site Request Forgery (CSRF).

Every one of the 7 issues recorded for WP Maintenance has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each. WP Maintenance is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 0.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Maintenance vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2019-19979

WP Maintenance <= 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

7 records


2025-05-07 00:00	WP Maintenance <= 6.1.9.7 - Authenticated (Administrator+) PHP Object Injection WP Maintenance <= 6.1.9.7	`CVE-2025-47683`	7.2 High	Ngo Bui Truong Vu	Yes
2024-06-18 00:00	WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass WP Maintenance <= 6.1.9.2	`CVE-2024-0789`	5.3 Medium	Hoa Le Ngoc (lengochoa)	Yes
2024-02-16 00:00	WP Maintenance <= 6.1.6 - Information Exposure WP Maintenance <= 6.1.6	`CVE-2024-1472`	5.3 Medium	Francesco Carlucci	Yes
2023-11-14 00:00	WP Maintenance <= 6.1.3 - IP Restriction Bypass WP Maintenance <= 6.1.3	`CVE-2023-47769`	5.3 Medium	Kévin Mosbahi (Mika)	Yes
2022-06-28 13:50	WP Maintenance <= 6.0.7 - Authenticated (Admin+) Cross-Site Scripting WP Maintenance <= 6.0.7	`CVE-2022-30536`	5.5 Medium	R3N0	Yes
2022-04-15 12:44	WP Maintenance <= 6.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting WP Maintenance <= 6.0.5	`CVE-2021-36828`	5.5 Medium	Asif Nawaz Minhas	Yes
2019-11-19 00:00	WP Maintenance <= 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting WP Maintenance <= 5.0.5	`CVE-2019-19979`	8.8 High	Chloe Chamberland	Yes

Showing 1–7 of 7 reports

Latestv6.1.10.1

WP Maintenance

Author

Florent Maillefaud

4.7(98)

94/100

Last Updated

2026-06-09 (3mo ago)

Active Installs

50,000+

Downloads

1,385,818

Requires WP

3.0+

Requires PHP

Tested up to

WP 0

Created

2013-02-13 (14y ago)

The WP Maintenance plugin allows you to put your website on the waiting time for you to do maintenance or launch your website. Personalize this page, pictures and countdown with: Features Choice texts colors and fonts Upload logo picture Upload background picture or pattern Countdown Custom Code Header for Analytics ready Social Networks ready Customize CSS Insert for shorcode (Newletter or Contact form) Enable “503 Service temporarily unavailable” Choose access by Roles and Capabilities Choose access by ID Pages Choose access by IP addresses wp-maintenance.pot file available

View on WordPress.org