The Countdown – Block Countdown Timer plugin for WordPress contains a stored cross‑site scripting vulnerability that stems from the clientId parameter not being properly sanitized or escaped. An authenticated user with Contributor level access or higher can inject arbitrary JavaScript. The injected script will run whenever a user views a page that includes the malicious clientId value, potentially permitting code execution within the victim’s browser context.

All releases of the Countdown – Block Countdown Timer plugin by zourbuth up to and including version 2.0.1 are affected. WordPress sites that have installed any of these versions are at risk.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% points to a low probability of active exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers need authenticated access with at least Contributor privileges, and they can exploit the flaw by submitting a crafted clientId value through the plugin’s management interface or an exposed API endpoint.