Easy Timer
Easy Timer has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Code Injection, behind 1 of the records (100%).
The one issue recorded for Easy Timer has a vendor fix available, so running the current release closes it.
All of these findings were reported by Jonas Benjamin Friedli. Easy Timer is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-9519Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode
Read the full analysisVulnerability Records
Easy Timer
Author
Kleor
Easy Timer allows you to easily insert into posts, pages and widgets of your website an unlimited number of count down/up timers that refresh every second, and the time or date. Each countdown timer shows the time remaining until the date you choose, and, if you want, reveals a hidden content when this date is reached. Each countup timer shows the time elapsed since the date you choose or the time spent by the Internet user on the webpage. Easy Timer also allows you to schedule an automatic content modification. Documentation Translators Aboelabbas (Arabic) Ales J. (Czech) Alexander Ovsov (Belarusian) Chris K. (Hungarian) Dave (Portuguese) Dovis (Chinese) Flemming (Danish) Gunlukucretsiz (Turkish) Johan (Swedish) Kaloyan (Bulgarian) Krzysztof (Polish) Mihalcea (Romanian) Omer (Hebrew) Peter (Slovak) Reza E. (Persian) Sofokli (Albanian) Tohru M. (Japanese) Vladimir (Russian) Plugins from the same author Commerce Manager, to sell your products Affiliation Manager, to create your affiliate program Membership Manager, to create your members areas Optin Manager, to build your prospects lists Contact Manager, to create your contact forms Content Switcher, to display random or variable contents Device Detect, to detect smartphones and tablets
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C