Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8 there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - \Newsletter\ tab &yith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the context i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - \General\ tab issues vulnerable parameters: &yith_maintenance_message &yith_maintenance_custom_style &yith_maintenance_mascotte &yith_maintenance_title_fontsize &yith_maintenance_title_fontfamily &yith_maintenance_title_fontcolor &yith_maintenance_paragraph_fontsize &yith_maintenance_paragraph_fontfamily &yith_maintenance_paragraph_fontcolor &yith_maintenance_border_top. 3 - \Background\ tab issues vulnerable parameters: &yith_maintenance_background_image &yith_maintenance_background_color. 4 - \Logo\ tab issues vulnerable parameters: &yith_maintenance_logo_image &yith_maintenance_logo_tagline &yith_maintenance_logo_tagline_fontsize &yith_maintenance_logo_tagline_fontfamily &yith_maintenance_logo_tagline_fontcolor. 5 - \Newsletter\ tab issues vulnerable parameters: &yith_maintenance_newsletter_email_fontsize &yith_maintenance_newsletter_email_fontfamily &yith_maintenance_newsletter_email_fontcolor &yith_maintenance_newsletter_submit_fontsize &yith_maintenance_newsletter_submit_fontfamily &yith_maintenance_newsletter_submit_fontcolor &yith_maintenance_newsletter_submit_background &yith_maintenance_newsletter_submit_background_hover &yith_maintenance_newsletter_title &yith_maintenance_newsletter_action &yith_maintenance_newsletter_email_label &yith_maintenance_newsletter_email_name &yith_maintenance_newsletter_submit_label &yith_maintenance_newsletter_hidden_fields. 6 - \Socials\ tab issues vulnerable parameters: &yith_maintenance_socials_facebook &yith_maintenance_socials_twitter &yith_maintenance_socials_gplus &yith_maintenance_socials_youtube &yith_maintenance_socials_rss &yith_maintenance_socials_skype &yith_maintenance_socials_email &yith_maintenance_socials_behance &yith_maintenance_socials_dribble &yith_maintenance_socials_flickr &yith_maintenance_socials_instagram &yith_maintenance_socials_pinterest &yith_maintenance_socials_tumblr &yith_maintenance_socials_linkedin.