This vulnerability arises because the plugin fails to properly neutralize user‑supplied data before incorporating it into generated web pages, enabling stored cross‑site scripting. An attacker who can submit crafted input to the plugin’s interface can have that input stored in the site’s database. Subsequent visitors who load pages that display the stored content will have the attacker’s script executed in their browser, allowing the attacker to run arbitrary client‑side code with the privileges of the visitor.

WordPress installations that have the ProWCPlugins Product Time Countdown for WooCommerce plugin installed in any release from the initial launch up through version 1.6.2 are affected.

The CVSS score of 6.5 rates the flaw as medium severity, while the EPSS score of less than 1% indicates that exploitation activity has been rare. The vulnerability is not present in CISA’s KEV catalog. The attack does not require privileged access; an attacker only needs the ability to submit input through the plugin’s public interface, after which any user who views the affected page will execute the stored script.