Authorization Flaw in Countdown, Coming Soon, Maintenance Plugin for WordPress
CVE-2026-111033
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 November 2026
Badges
What is CVE-2026-111033?
The Countdown, Coming Soon, Maintenance plugin for WordPress lacks critical authorization and nonce validation during the saving process of countdown data on posts. This weakness allows users with Author-level access and higher to inject arbitrary web scripts. The output-sanitization allowlist incorrectly permits the use of script tags, posing a risk of cross-site scripting (XSS) attacks. When the impacted content is rendered, these scripts can execute in the context of users, which may lead to data breaches or further compromise of the site’s integrity.
Affected Version(s)
Countdown, Coming Soon, Maintenance 0 <= 3.0.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.