Widget Countdown CVE-2026-16495

Exploitation requires an authenticated account with contributor-level capabilities or higher (per the CVSS PR:L and the description) on a site running Countdown Timer - Widget Countdown ≤3.0.1, and the attacker must be able to use the plugin's shortcode and supply the 'redirect_url' attribute. The payload is stored, so execution is deferred until a user accesses the injected page - meaning impact depends on another user (ideally a higher-privileged admin) viewing that page. Limiting factors: no unauthenticated path (requires a contributor+ account, so sites that do not allow untrusted users to author content are far less exposed), and the plugin must be installed and its shortcode usable by the attacker.

This is a moderate-severity stored XSS (CWE-79) with a CVSS of 6.4. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation, but PR:L confirms it is NOT unauthenticated - the attacker needs at least contributor-level access, which materially lowers real-world risk since contributor accounts are a trusted (if low-privilege) role. The S:C (scope change) and C:L/I:L reflect that the injected script executes in the browser of other users who view the page, not on the server itself. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. The signals are internally consistent (no CVSS-vs-description conflict): the description's 'authenticated attackers, with contributor-level access and above' aligns cleanly with PR:L. Net assessment: a genuine but not emergency priority - realistic risk is bounded by the requirement for an authenticated contributor account, making this most relevant to multi-author sites or sites with open/low-trust registration.

An attacker who holds (or registers for) a contributor-level account on a WordPress site running this plugin inserts a Countdown Timer shortcode with a malicious 'redirect_url' attribute containing JavaScript. Because input is insufficiently sanitized and output is not escaped, the payload is stored and then executes in the browser of any user - including administrators - who later views the page, enabling session/cookie theft or admin-action abuse. No public exploit code is identified at time of analysis, though the attack path is straightforward given low attack complexity (AC:L).