CVE-2026-111033

Not scored yetLast modified Nov 14, 2026

Description

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 14, 2026
Last modified
Nov 14, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-111034The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before retCVE-2026-1110368.4Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functioCVE-2026-1110375.1A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability ariCVE-2026-1110387.3CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises becauseCVE-2026-111046.5Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtCVE-2026-1110405.1The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can injCVE-2026-1110414.9The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwiCVE-2026-1110447.6Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificaCVE-2026-1110457.5CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypassCVE-2026-1110462.3FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive noCVE-2026-1110488.4FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores CVE-2026-111056.5Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th
CVE-2026-111033: Unscored | Vulnix