Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Author+ Stored XSS via savePost

Description

The plugin does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.