The Countdown Timer – Widget Countdown plugin contains a stored Cross‑Site Scripting flaw in its wpdevart_countdown shortcode. Input supplied by users in shortcode attributes is not properly sanitized or escaped before being stored and later rendered on the front‑end, allowing an authenticated attacker with contributor or higher privileges to inject arbitrary JavaScript into pages. When a user views an injected page, the malicious script runs in the visitor’s browser, potentially compromising credentials, defacing content, or redirecting traffic.

WordPress sites that install the WPDevArt Countdown Timer – Widget Countdown plugin in versions 2.7.7 or earlier are affected. Any site using these plugin versions and allowing contributors or editors to add or modify content that includes the wpdevart_countdown shortcode can be exploited.

The CVSS score of 6.4 indicates a moderate impact, while an EPSS score of <1% shows a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher, making the attack surface internal to sites where such roles exist. Once injected, the stored XSS can affect all users who view the compromised page.