Threats tagged 'ghsa-3rr9-7ppg-8c4r'

The Countdown, Coming Soon, Maintenance WordPress plugin versions up to 3.0.8 lack authorization and nonce checks when saving countdown data. This flaw allows users with Author-level access or higher to inject arbitrary web scripts due to insufficient output sanitization that permits script tags. These scripts execute when the affected content is viewed on the front end or by administrators.