Stored XSS Vulnerability in WP Count Down Timer Plugin for WordPress

CVE-2025-12668

What is CVE-2025-12668?

The WP Count Down Timer plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization and escaping of user input within the 'wp_countdown_timer' shortcode parameters. This vulnerability affects all versions up to and including 1.0.1, enabling authenticated users with Contributor-level access and above to inject malicious scripts that execute whenever a user loads the compromised page. It is crucial for users and administrators to apply patches and follow security best practices to mitigate the risk associated with this vulnerability.

References