Activity Track Uji Countdown contains a reflected cross‑site scripting flaw caused by improper neutralization of user input during page rendering. The vulnerability allows an attacker to inject JavaScript that will execute in the victim’s browser when the crafted URL or form input is accessed. Exploitation can lead to session hijacking, theft of credentials, or defacement of the site by the user who views the malicious payload.

The flaw affects all installations of the Activity Track Uji Countdown plugin for WordPress versions up to and including 2.3.3. Sites that have not upgraded beyond this release are vulnerable and must be examined for current deployment.

With a CVSS score of 7.1 this issue rates as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker‑controlled input that is reflected back to the victim and relies on user interaction with a crafted link or form. The attack can be performed remotely from the internet without the need for privileged access to the server.