CVE-2021-34636 HIGH

CVE-2021-34636: Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting

Vendor Wpdevart
Product Countdown and CountUp, WooCommerce Sales Timers
Weakness CWE-352 · CSRF
Published September 28, 2021
Last update March 31, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.

Key dates

02Disclosure timeline

September 28, 2021 CVE published
March 31, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-5365 LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route CVE-2025-62933 WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2022-4621 Panasonic Sanyo CCTV Network Camera CVE-2023-24007 WordPress Admin Block Country Plugin <= 7.1.4 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-22689 WordPress Auto Affiliate Links Plugin <= 6.3 is vulnerable to Broken Access Control