CVE-2026-111033 · Package
NO FIX YET
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 saves countdown data without authorization or nonce checks, and its output filter allows script tags. A user with Author access or higher can store JavaScript that runs for visitors and for administrators who view the affected content.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Countdown, Coming Soon, Maintenance WordPress plugin through version 3.0.8 are exposed. The risk comes from users with Author-level access or above, who can save content that the plugin does not check or sanitize; sites with no Author or higher accounts beyond trusted staff face less risk. The sources do not say which version fixes it.
Not affected if plugin-above-3.0.8, plugin-not-installed
Who cares self-hosted, wordpress
Countdown, Coming Soon, Maintenance is installed and its version is 3.0.8 or earlier in the WordPress admin plugin listNo fix yet, per the sources.
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.