Stored Cross-Site Scripting Vulnerability in Countdown Timer for Elementor Plugin by WordPress

CVE-2025-8445

What is CVE-2025-8445?

The Countdown Timer for Elementor plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack due to inadequate input sanitization and output escaping in the 'countdown_label' parameter. Authenticated users with Contributor-level access or higher can exploit this vulnerability to inject arbitrary scripts, which will execute when users visit the affected pages. This poses significant risks, including unauthorized script execution and potential data breaches.

References