Countdown Timer Widget Countdown
Monthly
Stored cross-site scripting in the WordPress plugin Countdown Timer - Widget Countdown through version 3.0.1 allows an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into pages by supplying a malicious 'redirect_url' shortcode attribute. Because the payload is persisted, the script executes in the browser of any user - including administrators - who later views the injected page, yielding limited confidentiality and integrity impact within the affected site's origin (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is gated by the requirement for a contributor-or-higher account on a site running the plugin.
Stored cross-site scripting in the WordPress plugin Countdown Timer - Widget Countdown through version 3.0.1 allows an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript into pages by supplying a malicious 'redirect_url' shortcode attribute. Because the payload is persisted, the script executes in the browser of any user - including administrators - who later views the injected page, yielding limited confidentiality and integrity impact within the affected site's origin (CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is gated by the requirement for a contributor-or-higher account on a site running the plugin.