The wp custom countdown plugin contains an improper neutralization of user input, allowing stored cross‑site scripting. Unsanitized data entered through the plugin’s administrative interface is saved and later rendered on public pages, enabling an attacker to inject malicious scripts. This can lead to defacement, session hijacking, or exploitation of the victim’s browser context, affecting the confidentiality and integrity of user data.

This vulnerability impacts the wp custom countdown plugin from bishawjit-das, affecting all releases up to and including version 2.8. Users running the plugin at any of these versions are exposed.

The CVSS score of 6.5 indicates a moderate risk of exploitation. The EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA KEV. Likely, an attacker would craft payloads through the plugin’s admin input field or any exposed configuration interface, have the input stored, and rely on the website’s users to trigger the malicious script when they view the affected page. This attack requires web access to the site and administration of the plugin, making it a localized but potentially wide‑impact risk.