This vulnerability in the WooCommerce Coming Soon Product with Countdown plugin (versions up to 5.0) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker can inject malicious scripts that persist and execute in the context of users visiting affected pages. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality, integrity, and availability. No vendor advisory or patch links are available, and no exploits are known in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially enabling theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited degree. The medium severity reflects these impacts combined with the required conditions for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor official WebCodingPlace communications for updates and apply any released fixes promptly.