Log out
Get PRO

Latest

Input validation vulnerability in The Countdown – Block Countdown Timer 2.0.1

  • Severity: medium-risk
  • Status: Open
  • Publication: June 25, 2025

The Countdown plugin for WordPress has a security issue that allows attackers to inject harmful code into web pages. This can be done by using the ‘clientId’ parameter in versions up to 2.0.1. The plugin does not properly filter or escape input, making it possible for attackers with Contributor-level access or higher to insert their own scripts into pages. These scripts will run whenever a user visits the affected page.

Detected in:

The Countdown – Block Countdown Timer open vulnerable versions: >= * <= 2.0.1

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.