Stored Cross-Site Scripting Vulnerability in SM CountDown Widget for WordPress
CVE-2025-11880

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Sm Countdown Widget
Vendor
CVE Published:
22 October 2025

What is CVE-2025-11880?

The SM CountDown Widget for WordPress is susceptible to Stored Cross-Site Scripting attacks. Versions up to 1.2 do not perform adequate input sanitization and output escaping on user-supplied attributes within the smcountdown shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious web scripts, leading to potential execution of harmful scripts whenever users visit affected pages. It is crucial to upgrade to the latest version to mitigate this risk and safeguard your website.

Affected Version(s)

SM CountDown Widget * <= 1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/smcountdown/ta...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gilang Asra Bilhadi
JSON
.