CVE-2026-111033: Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Author+ Stored XSS via savePost
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with Author-level access or higher can store arbitrary web scripts in countdown data. Exploitation does not require bypassing an authorization check or supplying a nonce during post save.
Where does the stored script execute?
The script executes when affected content is viewed on the front end. It can also execute in an administrator session if an administrator views the affected content.
How can I determine whether content has been affected?
Review countdown data associated with posts created or edited by Author-level or higher users for embedded script tags or other unexpected web script content. The affected plugin versions are through 3.0.8.