Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #11

WordPress countdown timer plugin hit by stored XSS flaw

Original: 🚨 EUVD-2026-100788 📊 Score: 6.4/10 (CVSS v3.1) 📦 Product: Countdown Timer – Widget Countdown 🏢 Vendor: wpdevart 📅 Update

A stored cross-site scripting vulnerability has been reported in the Countdown Timer – Widget Countdown plugin for WordPress by vendor wpdevart, tracked as EUVD-2026-100788 with a CVSS v3.1 score of 6.4. The flaw involves the plugin's 'redirect_url' shortcode, and the advisory was updated on 14 October 2026. Site owners using the plugin are being urged to review the advisory and apply any available fixes.

Why now: WordPress site administrators monitor vulnerability disclosures that could expose their sites to attackers.

wpdevartCountdown Timer – Widget CountdownWordPressEUVD-2026-100788

Open on mastodon →

Evidence

• 🚨 EUVD-2026-100788 📊 Score: 6.4/10 (CVSS v3.1) 📦 Product: Countdown Timer – Widget Countdown 🏢 Vendor: wpdevart 📅 Updated: 2026-10-14 📝 The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/2212042