PT-2026-23241 · WordPress · Woocommerce Coming Soon Product With Countdown

Phat Rio · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-27354

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WooCommerce Coming Soon Product with Countdown versions through 5.0

Description The software contains a flaw related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be stored on the target server and executed by other users when they view the affected web page. The vulnerability exists due to insufficient input validation, potentially allowing an attacker to inject malicious code into the application.

Recommendations Update WooCommerce Coming Soon Product with Countdown to a version newer than 5.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27354

Affected Products

Woocommerce Coming Soon Product With Countdown

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-27354 · Security Note
• https://twitter.com/infoflowcloud/status/2029656131182719029 · Twitter Post
• https://twitter.com/CVEnew/status/2029654790100148631 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/woo-coming-soon-product/vulnerability/wordpress-woocommerce-coming-soon-product-with-countdown-plugin-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve · Note