The Countdown Timer for Elementor plugin (<= 1.3.6) contains a stored XSS vulnerability due to improper input sanitization during web page generation. This flaw allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No patch or official remediation guidance is currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the browsers of users who view the affected pages, potentially leading to partial compromise of confidentiality, integrity, and availability of user data or sessions. The vulnerability requires some user interaction and low privileges to exploit, and it affects the plugin's web page generation process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting plugin usage to trusted users and minimizing exposure. Monitor for updates from the vendor or plugin repository to apply official patches once released.