WPC Countdown Timer CVE-2025-49908
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Authenticated low-privilege user stores the payload (PR:L), a victim must load the page (UI:R), and script execution in the victim's browser crosses a trust boundary (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.
AnalysisAI
Stored cross-site scripting (XSS) in the WPC Countdown Timer for WooCommerce plugin (versions up to and including 3.1.4) enables an authenticated attacker with low-level privileges to inject malicious JavaScript into countdown timer settings. The payload executes in the browser of any user who views the affected page, potentially allowing session theft or defacement. No public exploit code has been identified and the EPSS score is low (0.20%), but the plugin's use in e-commerce sites warrants prompt patching per the Patchstack advisory.
Technical ContextAI
This is a CWE-79 improper neutralization of input during web page generation, specifically a stored XSS vulnerability in a WordPress plugin. The WPC Countdown Timer for WooCommerce plugin fails to properly sanitize or escape user-supplied input in its countdown timer configuration fields before storing it in the database and rendering it on front-end or admin pages. An attacker with at least low-level privileges (PR:L) can save a crafted payload that executes when another user (UI:R) loads the page, potentially altering the page's content or stealing cookies. The CVSS vector indicates network exploitable, low complexity, scope changed, with low confidentiality, integrity, and availability impact. The exact vulnerable field and required role threshold are not detailed in the available reference and should be confirmed via the Patchstack advisory.
Affected ProductsAI
WPC Countdown Timer for WooCommerce plugin, all versions up to and including 3.1.4. No specific CPE string is provided in the advisory. The plugin is developed by WPClever and is used to add countdown timers to WooCommerce stores. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wpc-countdown-timer/vulnerability/wordpress-wpc-countdown-timer-for-woocommerce-plugin-3-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve) is the primary reference and likely lists the affected and fixed versions.
RemediationAI
Update WPC Countdown Timer for WooCommerce to a version later than 3.1.4. The specific patched version is not stated in the provided data, so consult the Patchstack advisory for the exact fixed version. Until an update can be applied, restrict access to the plugin's countdown timer settings to trusted administrators only, as the vulnerability requires an authenticated account with privileges to modify timer configurations. Additionally, consider deploying a Web Application Firewall (WAF) with XSS filtering rules to block stored payloads, though this is a compensating control and may not fully mitigate the risk. Regularly audit user roles and capabilities to enforce least privilege and reduce the number of accounts that can inject content.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today