The vulnerability CVE-2025-24719 affects the wpdevart Widget Countdown WordPress plugin (up to version 2.7.1). It is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows an attacker with low privileges to inject malicious scripts that execute when a user views the affected page. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or disrupt availability. The impact is limited to confidentiality, integrity, and availability at a low level. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Widget Countdown plugin or restricting its use to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.