Skip to content
Noroxi

Countdown, Coming Soon, Maintenance – Countdown & Clock

countdown-builder · plugin

Known security vulnerabilities for Countdown, Coming Soon, Maintenance – Countdown & Clock. Find out in seconds which version runs on your site with WP Lens.

8 known vulnerabilities

2 critical · 2 exploitable without logging in · 1 with no official fix seen · latest Apr 4, 2025

Listed on wordpress.org · latest 3.0.8 · last updated Feb 8, 2026 · 10K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2025-30841login required≤ 2.8.8

    WordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerability

    Critical 9.9

  • CVE-2022-29423high privilege≤ 2.3.2

    WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability

    Critical 9.8

  • CVE-2025-2270unauthenticated≤ 2.8.9.1

    Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion

    High 8.1

  • CVE-2022-29421unauthenticated · needs a click≤ 2.3.2

    WordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-50516high privilegeno fix seen

    WordPress Countdown & Clock plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability

    Medium 5.9

  • CVE-2024-2017subscriber+≤ 2.7.8

    Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection

    Medium 5.4

  • CVE-2022-29422admin≤ 2.3.2

    WordPress Countdown & Clock plugin <= 2.3.2 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

    Medium 4.8

  • CVE-2022-29420high privilege≤ 2.3.2

    WordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Medium 4.8

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS). The record lists the latest wordpress.org release (3.0.8) as affected.

← Back to directory