CVE-2023-47533 MEDIUM

CVE-2023-47533: WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Vendor Wpdevart
Product Countdown and CountUp, WooCommerce Sales Timer
Weakness CWE-79 · XSS
Published November 14, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Countdown and CountUp plugin for WooCommerce contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.8.2. An authenticated administrator with high privileges can inject malicious JavaScript that executes in the browsers of other site users. The vulnerability requires user interaction to trigger and affects the plugin's countdown timer functionality.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that runs in other users' browsers when they view affected pages.

Potential impact on your site

04Site Impact

A compromised admin account can inject scripts that steal visitor data, redirect users, or deface your site content.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site and a user must view a page containing the injected payload.

Key dates

06Disclosure timeline

November 14, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57349 WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability CVE-2026-57671 WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-27425 WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57675 WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability CVE-2026-27402 WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability