The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin suffers from a stored DOM-based cross-site scripting vulnerability (CWE-79) due to inadequate sanitization and escaping of user input in the countdown timer feature. Authenticated users with Contributor-level privileges or above can inject malicious scripts that persist and execute in the context of other users viewing the affected pages. This vulnerability impacts all plugin versions up to 2.19.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and execute arbitrary JavaScript in the browsers of users who visit the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor for updates from the vendor or WordPress plugin repository regarding patches or official fixes.