CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2024-13113 – Countdown Timer for Elementor < 1.3.7 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-13113
26 Feb 2025 — The Countdown Timer for Elementor WordPress plugin before 1.3.7 does not sanitise and escape some parameters when outputting them on the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks. • https://wpscan.com/vulnerability/ffc31d9d-d245-4c4b-992d-394a01798117 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-53743 – WordPress Countdown Timer for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-53743
28 Nov 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs Countdown Timer for Elementor allows Stored XSS.This issue affects Countdown Timer for Elementor: from n/a through 1.3.6. The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc... • https://patchstack.com/database/wordpress/plugin/countdown-timer-for-elementor/vulnerability/wordpress-countdown-timer-for-elementor-plugin-1-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •