The vulnerability is a stored cross‑site scripting flaw in the Countdown widget of the Spexo Addons for Elementor plugin. Insufficient sanitization and escaping of user‑supplied attributes let attackers inject arbitrary JavaScript into pages. When a page containing the injected widget is viewed, the script runs in the victim’s browser, potentially disclosing sensitive information or hijacking user sessions. This flaw is classified as CWE‑79.

All installations of the Spexo Addons for Elementor plugin provided by TemplatesCoderThemes, versions 1.0.23 and earlier, are affected. The plugin adds a Countdown widget to WordPress sites via Elementor. Users must verify they are running a version above 1.0.23 to be exempt.

The CVSS score is 6.4, indicating moderate severity. EPSS is less than 1%, suggesting low likelihood of widespread exploitation, but the flaw remains relevant for sites that provide contributor‑level access or higher. Exploitation requires an authenticated contributor or higher, who can modify widget attributes through the WordPress administration interface and thereby inject malicious scripts. Once the script is stored it is executed for any user who visits the affected page. The absence of a KEV listing does not reduce the risk for sites with the vulnerability.