{"id":"CVE-2026-111033","kind":"vulnerability","aliases":["CVE-2026-111033"],"related":[],"title":"WordPress Countdown plugin lets authors store scripts that run on pages","description":"The Countdown, Coming Soon, Maintenance  WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.","summary":"The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 saves countdown data without authorization or nonce checks, and its output filter allows script tags. A user with Author access or higher can store JavaScript that runs for visitors and for administrators who view the affected content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-above-3.0.8","plugin-not-installed"],"how_to_check":"- Check whether the plugin `Countdown, Coming Soon, Maintenance` is installed and its version is `3.0.8` or earlier in the WordPress admin plugin list\n- Review which accounts hold the Author role or higher, since they can store the script","fix":null,"status":"open","published_at":"2026-11-14T07:17:16+00:00","first_seen_at":"2026-11-14T07:27:44+00:00","triaged_at":"2026-11-14T07:28:22+00:00","updated_at":"2026-11-14T07:28:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T07:28:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WordPress Countdown plugin lets authors store scripts that run on pages","impact":"medium","summary":"The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 saves countdown data without authorization or nonce checks, and its output filter allows script tags. A user with Author access or higher can store JavaScript that runs for visitors and for administrators who view the affected content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers and in administrator sessions","analyst_note":"Confirm the fixed version and any vendor advisory for the Countdown, Coming Soon, Maintenance plugin; NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-111033 gave no product ranges.","how_to_check":"- Check whether the plugin `Countdown, Coming Soon, Maintenance` is installed and its version is `3.0.8` or earlier in the WordPress admin plugin list\n- Review which accounts hold the Author role or higher, since they can store the script","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-3.0.8"],"who_is_affected":"Sites running the Countdown, Coming Soon, Maintenance WordPress plugin through version 3.0.8 are exposed. The risk comes from users with Author-level access or above, who can save content that the plugin does not check or sanitize; sites with no Author or higher accounts beyond trusted staff face less risk. The sources do not say which version fixes it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000777,"input_tokens":4576,"output_tokens":638,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111033':14A,17A '-2026':13A,16A '3.0.8':31B,77C 'access':51B,107C 'administr':63B,130C 'affect':67B,119C 'allow':44B,101C 'allowlist':97C 'arbitrari':112C 'author':5A,36B,50B,81C,105C 'author-level':104C 'check':39B,84C 'come':25B,71C 'content':68B,120C 'countdown':2A,24B,33B,70C,87C 'cve':12A,15A 'data':34B,88C 'end':126C 'execut':116C 'filter':43B 'front':125C 'higher':53B 'host':21B 'javascript':56B 'let':4A 'level':106C 'mainten':27B,73C 'nonc':38B,83C 'output':42B,95C 'output-sanit':94C 'packag':18B 'page':11A 'perform':80C 'permit':98C 'plugin':3A,29B,75C 'post':90C 'run':9A,58B 'sanit':96C 'save':32B,86C,91C 'script':7A,45B,99C,114C 'self':20B 'self-host':19B 'session':131C 'soon':26B,72C 'store':6A,55B,111C 'tag':46B,100C 'user':48B,102C 'view':65B,122C 'visitor':60B 'web':113C 'without':35B 'wordpress':1A,22B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Countdown, Coming Soon, Maintenance WordPress plugin through version 3.0.8 are exposed. The risk comes from users with Author-level access or above, who can save content that the plugin does not check or sanitize; sites with no Author or higher accounts beyond trusted staff face less risk. The sources do not say which version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-111033':14A,17A '-2026':13A,16A 'author':5A 'countdown':2A 'cve':12A,15A 'let':4A 'page':11A 'plugin':3A 'run':9A 'script':7A 'store':6A 'wordpress':1A","search_b":"'3.0.8':31B 'access':51B 'administr':63B 'affect':67B 'allow':44B 'author':36B,50B 'check':39B 'come':25B 'content':68B 'countdown':24B,33B 'data':34B 'filter':43B 'higher':53B 'host':21B 'javascript':56B 'mainten':27B 'nonc':38B 'output':42B 'packag':18B 'plugin':29B 'run':58B 'save':32B 'script':45B 'self':20B 'self-host':19B 'soon':26B 'store':55B 'tag':46B 'user':48B 'view':65B 'visitor':60B 'without':35B 'wordpress':22B,28B","search_c":"'3.0.8':77C 'access':107C 'administr':130C 'affect':119C 'allow':101C 'allowlist':97C 'arbitrari':112C 'author':81C,105C 'author-level':104C 'check':84C 'come':71C 'content':120C 'countdown':70C,87C 'data':88C 'end':126C 'execut':116C 'front':125C 'level':106C 'mainten':73C 'nonc':83C 'output':95C 'output-sanit':94C 'perform':80C 'permit':98C 'plugin':75C 'post':90C 'sanit':96C 'save':86C,91C 'script':99C,114C 'session':131C 'soon':72C 'store':111C 'tag':100C 'user':102C 'view':122C 'web':113C 'wordpress':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111033","severity":null,"published_at":"2026-11-14T07:17:16+00:00","modified_at":"2026-11-14T07:17:16+00:00","first_seen_at":"2026-11-14T07:27:44+00:00","fetched_at":"2026-11-14T07:27:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}