CVE-2026-27354

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27354", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:51:41.702Z", "datePublished": "2026-03-05T05:53:53.894Z", "dateUpdated": "2026-04-28T16:15:02.216Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "woo-coming-soon-product", "product": "WooCommerce Coming Soon Product with Countdown", "vendor": "WebCodingPlace", "versions": [{"lessThanOrEqual": "5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:16.683Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.<p>This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:02.216Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/woo-coming-soon-product/vulnerability/wordpress-woocommerce-coming-soon-product-with-countdown-plugin-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T19:03:52.457639Z", "id": "CVE-2026-27354", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T16:01:17.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-27354", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T19:03:52.457639Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T19:03:27.285Z"}}], "cna": {"title": "WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "affected": [{"vendor": "WebCodingPlace", "product": "WooCommerce Coming Soon Product with Countdown", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.0"}], "packageName": "woo-coming-soon-product", "collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:05:16.683Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/woo-coming-soon-product/vulnerability/wordpress-woocommerce-coming-soon-product-with-countdown-plugin-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.<p>This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T14:15:10.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27354", "state": "PUBLISHED", "dateUpdated": "2026-04-01T14:15:10.516Z", "dateReserved": "2026-02-19T09:51:41.702Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:53:53.894Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://codecanyon.net", "defaultStatus": "unaffected", "packageName": "woo-coming-soon-product", "product": "WooCommerce Coming Soon Product with Countdown", "vendor": "WebCodingPlace", "versions": [{"lessThanOrEqual": "5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0."}, {"lang": "es", "value": "Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') vulnerabilidad en WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product permite XSS Almacenado. Este problema afecta a WooCommerce Coming Soon Product with Countdown: desde n/a hasta &lt;= 5.0."}], "id": "CVE-2026-27354", "lastModified": "2026-06-17T10:27:04.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27354", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T19:03:52.457639Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:25.537", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/woo-coming-soon-product/vulnerability/wordpress-woocommerce-coming-soon-product-with-countdown-plugin-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WooCommerce Coming Soon Product with Countdown", "source": "cna", "vendor": "WebCodingPlace"}, "product": "woocommerce_coming_soon_product_with_countdown", "vendor": "webcodingplace"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T12:44:46.242393+00:00", "value": {"mitigation_remediation": ["Upgrade WooCommerce Coming Soon Product with Countdown to the latest version that contains the fix", "Disable the plugin or remove the affected product pages until a patch is applied to prevent execution of stored scripts on live sites", "Remove any malicious HTML or JavaScript payloads that may already be present in the database or product descriptions"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (XSS) compromising page content"}, "threat_synthesis": {"affected_systems": "WebCodingPlace\u2019s WooCommerce Coming Soon Product with Countdown plugin for WordPress is affected for all releases up through version 5.0 inclusive. Administrators who have editing rights on the plugin settings or product pages could introduce the malicious payload.", "description_and_impact": "The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are then stored in the product page. When a visitor loads the affected page, the injected code executes in their browser, potentially leading to site defacement, cookie theft, or session hijacking. This stored XSS flaw is significant because it can affect all users who view the compromised content.", "risk_and_exploitability": "With a CVSS score of 6.5, the vulnerability presents moderate severity. The EPSS score is below 1\u202f%, indicating a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to access the plugin\u2019s configuration or content editing interface\u2014likely requiring authenticated privileged access\u2014to inject the script, after which the stored payload would execute for any user who views the product page."}}}}, "created": "2026-03-06T15:13:29.892010+00:00", "updated": "2026-04-16T12:45:35.860405+00:00", "vendors": ["webcodingplace", "webcodingplace$PRODUCT$woocommerce_coming_soon_product_with_countdown", "wordpress", "wordpress$PRODUCT$wordpress"]}