Cross-site Scripting Vulnerability in WPC Countdown Timer for WooCommerce by WPClever
CVE-2025-49908

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WPc Countdown Timer For WooCommerce
Vendor
CVE Published:
22 October 2025

What is CVE-2025-49908?

The WPC Countdown Timer for WooCommerce, a plugin developed by WPClever, contains a Cross-site Scripting (XSS) vulnerability that permits an attacker to inject malicious scripts in web pages. This issue affects users of versions up to and including 3.1.4, making their sites susceptible to stored XSS attacks, where the injected script can be executed when other users visit the affected page.

Affected Version(s)

WPC Countdown Timer for WooCommerce <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/wpc-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
JSON
.
CVE-2025-49908 : Cross-site Scripting Vulnerability in WPC Countdown Timer for WooCommerce by WPClever