The Peter’s Date Countdown WordPress plugin contains a reflected cross‑site scripting flaw caused by an unsanitized use of the PHP variable $_SERVER['PHP_SELF']. An attacker who can entice a user to visit a specially crafted link can inject JavaScript that runs in the victim’s browser, allowing the execution of arbitrary code within the context of the site. This CWE‑79 vulnerability does not require authentication and is limited to the victim’s session, but it can be used to hijack sessions, deface pages, or launch further attacks.

The vulnerability is present in all releases of the Peter’s Date Countdown plugin up to and including version 2.0.0. WordPress sites running any of those versions of the plugin are potentially exposed.

The CVSS score is 6.1, indicating moderate severity. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting current exploitation likelihood is low. However, the flaw is trivially exploitable via a crafted URL, requires no authentication, and relies only on a typical user interaction (clicking a link). As such, the risk profile is moderate, with potential for abuse in phishing or social engineering scenarios.