The wpdevart Widget Countdown plugin contains a stored cross‑site scripting weakness that allows attackers to submit input without proper sanitization, which is then rendered on WordPress pages that contain the widget. Because the vulnerability is stored, the malicious script is persisted in the site’s database and executed in the browsers of anyone who views the affected widget, exposing browsers to arbitrary client‑side code.

WordPress sites that have installed the Widget Countdown plugin version 2.7.4 or older are affected. The flaw exists in all releases through 2.7.4 and is resolved in later versions. Sites using the widget on public or private pages that are accessible to editors or administrators fall within the risk scope.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. The attack likely requires an attacker who can submit or modify widget content—such as a user with editor or administrator privileges—in order to inject the malicious script.