The Countdown Timer for Elementor plugin suffers from a stored XSS vulnerability due to improper neutralization of input in the 'countdown_label' parameter. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code into pages, which executes in the context of users viewing those pages. The vulnerability affects all versions up to and including 1.3.9. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the low level, no user interaction needed, and a scope change with limited confidentiality and integrity impact but no availability impact.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser context. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the Countdown Timer for Elementor plugin if possible. Monitor official vendor channels for updates regarding patches or mitigations.