PLUGIN SECURITY
Is Coming Soon safe?
Easy Drag & Drop Page Builder. A complete solution to create a WordPress Website, Custom Themes, Landing Pages, Coming Soon & Maintenance Mode Pages.
What this plugin does
- Slug:
coming-soon - Author: SeedProd
- 700000+ active installs
- 98/100 rating (4699 reviews on wordpress.org)
- 35958661 all-time downloads
- On WordPress.org since 2014-01-21
coming soon pagelanding pagemaintenance modepage builderwebsite builder
Maintenance status
- Latest known version: 6.20.7
- Last updated: 2026-08-24 1:50pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 5.6+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
10 known CVEs on file for Coming Soon.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-14785 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.20.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 6.20.3 | 6.20.3 | 2026-07-07 | ✓ fixed in latest |
| CVE-2026-39464 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.19.9 | — | Medium 5.5 | < 6.19.9 | 6.19.9 | 2026-03-14 | ✓ fixed in latest |
| CVE-2026-27368 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.19.9 | Missing Authorization | Medium 5.3 | < 6.19.9 | 6.19.9 | 2025-12-24 | ✓ fixed in latest |
| CVE-2025-24540 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.18.10 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 6.18.10 | 6.18.10 | 2024-11-09 | ✓ fixed in latest |
| CVE-2024-47299 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.18.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 6.18.4 | 6.18.4 | 2024-09-24 | ✓ fixed in latest |
| CVE-2024-32088 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.15.21 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 6.15.21 | 6.15.21 | 2024-04-11 | ✓ fixed in latest |
| CVE-2024-1072 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.15.22 | Missing Authorization | High 7.5 | < 6.15.22 | 6.15.22 | 2024-01-31 | ✓ fixed in latest |
| CVE-2023-4975 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.15.15.3 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 6.15.15.3 | 6.15.15.3 | 2023-09-18 | ✓ fixed in latest |
+ 5 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2020-15038 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 5.1.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 5.1.2 | 5.1.2 | 2020-06-24 | ✓ fixed in latest |
| — | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.18.16 | Missing Authorization | Medium 4.3 | < 6.18.16 | 6.18.16 | 0000-00-00 | ✓ fixed in latest |
| — | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode [coming-soon] < 6.15.22 | — | Unknown | < 6.15.22 | 6.15.22 | — | ✓ fixed in latest |
| CVE-2024-1072 | Website Builder by SeedProd < 6.15.22 - Unauthenticated Plugin Page Content Update | — | Unknown | < 6.15.22 | 6.15.22 | — | ✓ fixed in latest |
| CVE-2025-3949 | Website Builder by SeedProd < 6.18.16 - Subscriber+ Sensitive Information Exposure | — | Unknown | < 6.18.16 | 6.18.16 | — | ✓ fixed in latest |
How to fix it
Keep Coming Soon updated — 6.20.7 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7296)
- Maintenance — 1000000+ active installs — 88/100 (859) — max PHP 8.4
- Under Construction — 600000+ active installs — 96/100 (1285) — max PHP 8.4
- LightStart – Maintenance Mode, Coming Soon and Landing Page Builder — 400000+ active installs — 86/100 (873) — max PHP 8.4
- Page Builder: Pagelayer – Drag and Drop website builder — 400000+ active installs — 78/100 (102) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.