The Countdown Timer – Widget Countdown plugin is susceptible to stored cross‑site scripting through the 'redirect_url' shortcode attribute. Because the input is neither properly sanitized nor escaped, an authenticated contributor or higher can embed arbitrary JavaScript that survives in the database and runs whenever a page containing the shortcode is viewed.

WordPress sites that have the Countdown Timer – Widget Countdown plugin, any version up to and including 3.0.1, are vulnerable. The problem persists across all revisions inspected up to that release, so any portable older instance remains at risk unless upgraded.

The SAAS scoring lists a CVSS of 6.4, denoting moderate severity, and an EPSS of less than 1%, indicating a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need contributor‑level access to inject the payload; once injected, the payload executes in the context of every visitor to the affected page, potentially enabling session hijacking or defacement. Based on the description, these potential impacts are inferred rather than explicitly stated by the CVE data. The stored nature of the flaw means that the injection does not require repeated interaction with the site, further lowering the barrier for exploitation.