Stored Cross-site Scripting Vulnerability in Smart Countdown FX by Alex Polonski

CVE-2025-25117

Summary

A Stored Cross-site Scripting (XSS) vulnerability exists in the Smart Countdown FX plugin by Alex Polonski, specifically affecting versions from n/a to 1.5.5. This flaw arises from improper sanitization of input during web page generation, allowing attackers to inject malicious scripts that are stored on the server. When other users access affected pages, the scripts execute in their browsers, potentially compromising their data and accounts. It is crucial for users to update their installations and implement security measures to mitigate this risk.

References