Description
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Countdown, Coming Soon, Maintenance | 0 ≤3.0.8 | — |