{"affected":[{"defaultStatus":"unknown","product":"Countdown, Coming Soon, Maintenance","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"3.0.8","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-111033","cwes":["CWE-79"],"description":"The Countdown, Coming Soon, Maintenance  WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/7f5c11a9-86dd-495b-83ae-3f53cac275b9/"}],"kev":null,"metrics":[],"modifiedAt":1794636005628,"publishedAt":1794636005628,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/7f5c11a9-86dd-495b-83ae-3f53cac275b9/"}],"remediation":[],"revision":"d3c49fe5bb82e3eaa041b10791722aaf6348d862eb095fc07551f3394922c967","sources":[{"modifiedAt":1794636005628,"name":"CNA: WPScan","retrievedAt":1794640100753,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111033"}],"ssvc":null,"status":"published","title":"Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Author+ Stored XSS via savePost","updatedAt":1794640100753}