Huseyn

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when saving countdown data on post save, and its output-sanitization allowlist permits script tags, allowing users with Author-level access and above to store arbitrary web scripts that execute when the affected content is viewed on the front end or in an administrator session.

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.

Insufficient authorization checks allow users with the contributor role and above to change the type and order of posts they are not permitted to edit. This allows an attacker to convert posts and pages belonging to other users into portfolio items, which removes them from their original listings and URLs.

An Insecure Direct Object Reference (IDOR) exists on the order confirmation page. The plugin fails to verify if a visitor possesses the required order key before displaying order details. This allows unauthenticated users to retrieve the billing location, purchased products, and order totals of other customers by enumerating order IDs.

The plugin fails to sanitize and escape values submitted by unauthenticated users before they are stored in the activity log and subsequently displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.