SeedProd Coming Soon Page Pro

SeedProd Coming Soon Page Pro ✅ Known Vulnerabilities & Issues SeedProd (the “Website Builder by SeedProd” plugin) has had several security issues in past versions, including recent ones that affect versions near 6.18.x. Some are fixed in later versions, others are relevant to your version. Here are the key ones: Remote File Inclusion / Remote Code Execution (RCE) – Authenticated (Editor + ) SeedProd Pro versions up to & including are vulnerable to Remote File Inclusion (RFI) / remote code execution for authenticated users of Editor-level or above. Since 6.18.17 is higher than 6.18.13, it’s plausible that fix was applied, but you should check if your specific build includes the patch. SQL Injection (SQLi) – Authenticated Editor Versions have a SQL injection vulnerability owing to improper escaping. If your version is, this may have been patched, but only if your plugin is official and unmodified. Sensitive Information Exposure – Subscriber+ Versionsallow subscriber-level users to access certain internal data (revisions, settings) that should be restricted. There is a more specific issue CVE-2025-3949: in versions, an authenticated user (Subscriber-level) can access arbitrary landing page revisions via a function seedprodliteget_revisions that fails authorization checks. The fix for that issue is included in version Cross-Site Request Forgery (CSRF) to Settings / Unauthenticated Page Updates Earlier versions (below ~) had CSRF vulnerabilities allowing unauthorized settings updates. The plugin “Website Builder by SeedProd <= 6.15.13.1” is vulnerable to CSRF to settings changes.Stored / Reflected XSS in older versions Very early versions (<= 5.1.0) of the original “Coming Soon / Maintenance Mode” plugin had stored XSS issues.Also, “Editor+ Stored XSS” for versions less than 6.18.4 is listed in WPScan for the SeedProd plugin. Disallowed / Unsafe Nullled Versions Use of “nulled” (pirated) SeedProd Pro copies removes access to updates and may include malicious payloads. The official site warns that “SeedProd Nulled has no plugin updates” and that outdated versions are more vulnerable. 📊 Risk Assessment for Version Given these vulnerabilities and their fixed versions: The SQL injection and remote file inclusion / RCE issues affect versions up to. If includes the patch, those are mitigated—but only if your installation is unmodified and you've applied official updates. The sensitive info / revision exposure bug (CVE-2025-3949) affects versions and the fix is in So should include a fix for that. Some older CSRF and XSS vulnerabilities are for much earlier versions; if you're on 6.18.17, those should already be addressed in core plugin code. However, if your version is a pirated / modified copy, or if updates were not properly applied, you may still be vulnerable. Thus, SeedProd is exposed to serious risk if it does not include the patches fromlikely includes those patches in the official build.