Cross-site Scripting Vulnerability in WPC Countdown Timer for WooCommerce by WPClever
CVE-2025-49908

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WPc Countdown Timer For WooCommerce
Vendor
CVE Published:
22 October 2025

What is CVE-2025-49908?

The WPC Countdown Timer for WooCommerce, a plugin developed by WPClever, contains a Cross-site Scripting (XSS) vulnerability that permits an attacker to inject malicious scripts in web pages. This issue affects users of versions up to and including 3.1.4, making their sites susceptible to stored XSS attacks, where the injected script can be executed when other users visit the affected page.

Affected Version(s)

WPC Countdown Timer for WooCommerce 0 <= 3.1.4

References

https://patchstack.com/database/Wordpress/Plugin/wpc-coun...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
.