{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8445", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-31T19:16:52.623Z", "datePublished": "2025-09-11T07:24:53.269Z", "dateUpdated": "2026-04-08T16:51:35.531Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:35.531Z"}, "affected": [{"vendor": "shaikhaezaz80", "product": "Countdown Timer for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Countdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddcb9e7-506d-408d-812b-b95610b636f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/countdown-timer-for-elementor/trunk/widgets/countdown-timer-widget.php#L513"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-09-10T18:56:11.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:05:44.855747Z", "id": "CVE-2025-8445", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:40:16.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8445", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:05:44.855747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:05:46.649Z"}}], "cna": {"title": "Countdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "shaikhaezaz80", "product": "Countdown Timer for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:56:11.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddcb9e7-506d-408d-812b-b95610b636f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/countdown-timer-for-elementor/trunk/widgets/countdown-timer-widget.php#L513"}], "descriptions": [{"lang": "en", "value": "The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:35.531Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8445", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:35.531Z", "dateReserved": "2025-07-31T19:16:52.623Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:53.269Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-8445", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-11T08:15:34.450", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/countdown-timer-for-elementor/trunk/widgets/countdown-timer-widget.php#L513"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddcb9e7-506d-408d-812b-b95610b636f1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:50:11.466422+00:00", "value": {"mitigation_remediation": ["Apply any available update to the Countdown Timer for Elementor plugin.", "Restrict or temporarily revoke Contributor and higher roles from users who do not require timer editing to limit possible injection.", "Apply a web application firewall or implement a content security policy that blocks the execution of inline scripts from untrusted input sources, thereby mitigating the risk of stored XSS when the underlying flaw remains unresolved."], "summary": {"action": "Check update", "impact": "Stored cross-site scripting allowing arbitrary script execution by authenticated users with Contributor or higher privileges"}, "threat_synthesis": {"affected_systems": "The affected component is the Countdown Timer for Elementor WordPress plugin. All versions up to and including 1.3.9 are vulnerable. The plugin is distributed by shaikhaezaz80 and can be found under the \"Countdown Timer for Elementor\" category in the WordPress plugin repository.", "description_and_impact": "The vulnerability arises from the Countdown Timer for Elementor plugin permitting stored cross\u2011site scripting through the 'countdown_label' field. Improper input sanitization ensures that an attacker can embed malicious JavaScript that is persisted and executed whenever any user views a page containing the injected timer. This flaw grants attackers arbitrary client\u2011side code execution, compromising visitor confidentiality and potentially enabling credential theft, session hijacking, or defacement. The weakness is classified as CWE\u201179.", "risk_and_exploitability": "It is inferred from the CVE description that attackers can inject malicious payloads via the 'countdown_label' field. While the exact path is not explicitly spelled out, it is likely that the attack vector involves the timer widget editing interface, requiring authenticated Contributor or higher access. Once the payload is stored, the script runs automatically for any visitor accessing the affected page, multiplying the impact across all site users. The CVSS score of 6.4 denotes moderate severity. The EPSS score of less than 1% indicates that the likelihood of exploitation by known actors is low at this time, and the vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2025-09-12T09:11:21.732754+00:00", "updated": "2026-04-22T01:00:04.358283+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "shaikhaezaz80", "shaikhaezaz80$PRODUCT$countdown_timer_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}