Countdown Timer – Widget Countdown

Countdown Timer – Widget Countdown has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 3 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, most of them (2) reported by Muhammad Yudha - DJ.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all Countdown Timer – Widget Countdown vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-16495

Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute

Read the full analysis

Vulnerability Records

4 records


2026-10-13 15:36	Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute Countdown Timer 3.0.0 – 3.0.1	`CVE-2026-16495`	6.4 Medium	Yuto Hyakumoto	No
2026-01-09 00:00	Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Countdown Timer <= 2.7.7	`CVE-2025-14555`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-05-07 00:00	Widget Countdown <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Countdown Timer <= 2.7.4	`CVE-2025-47443`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-01-24 00:00	Widget Countdown <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Countdown Timer <= 2.7.1	`CVE-2025-24719`	6.4 Medium	Peter Thaleikis	Yes

Showing 1–4 of 4 reports