The SM CountDown Widget plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because the plugin does not properly sanitise or escape user‑supplied attributes of the smcountdown shortcode. This flaw allows an authenticated user with contributor‑level access or higher to inject malicious JavaScript that is persisted and will run whenever the affected page is rendered, potentially affecting any visitor who loads that page. The weakness is classified as CWE‑79.

WordPress sites that have the SM CountDown Widget plugin installed, in any version up to and including 1.2 released by Sierramike. Only users with at least contributor privileges can exploit the flaw, but the malicious code will execute for all site visitors when the stored data is displayed.

The CVSS score of 6.4 indicates a moderate impact, while the EPSS score of less than 1% shows that real‑world exploitation is currently considered low probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the WordPress site as a contributor or higher, the attacker then creates or edits a shortcode instance with injected script content that is later stored in the database. When any user opens the page containing the shortcode, the injected script runs in the context of the site, enabling data theft, session hijacking, or defacement.