Woo Coming Soon Product Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.

Affected:

up to 5.0

Fix:

No patched version reported

Disclosed:

Mar 5, 2026

CVE-2026-27354 on NVD →

The WooCommerce Coming Soon Product with Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arb...

CVSS:

6.4

Affected:

up to 5.0

Fix:

No patched version reported

Disclosed:

Feb 25, 2026

CVE-2026-27354 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows PHP Local File Inclusion.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a...

Affected:

up to 5.0

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2025-68552 on NVD →

The WooCommerce Coming Soon Product with Countdown plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of...

CVSS:

7.5

Affected:

up to 5.0

Fixed in:

5.1

Disclosed:

Feb 10, 2026

CVE-2025-68552 on NVD →