CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.4.
Explanation of Vulnerability in Simple Terms
Widget Countdown versions up to 2.7.4 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into widget settings. When other users view pages containing the widget, the injected code executes in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires user interaction to trigger.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view affected widget content.
Potential impact on your site
Authenticated attackers can compromise visitor sessions, steal credentials, or deface site content through injected scripts.
Conditions required to exploit
Attacker needs a low-privilege WordPress account and must trick a user into viewing a page with the malicious widget.
Key dates
External resources
