Incorrect input sanitization in the Smart Countdown FX WordPress plugin allows attackers to inject malicious scripts that are stored in the database and later executed when page content is rendered. This stored cross‑site scripting flaw can lead to theft of session cookies, defacement of content, and execution of arbitrary code in the context of the visitor’s browser. The weakness is a classic example of CWE‑79, where user-controllable data is not properly neutralized before appearing in HTML output.

Alex Polonski’s Smart Countdown FX plugin for WordPress, versions from the earliest release through 1.5.5 inclusive, is affected by this stored XSS vulnerability.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity. The EPSS score of < 1% denotes a very low likelihood of exploitation, and it is not listed in the CISA KEV catalog, suggesting it has not yet been widely leveraged in the wild. However, the stored XSS nature means any malicious payload delivered through the plugin’s input fields could be displayed to all site users and trigger cross‑site attacks from any visitor of the page. The attack vector is likely through standard WordPress administrative or front‑end interfaces that allow content creation and manipulation within the plugin’s scope.