CVE-2026-16495: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevart Countdown Timer – Widget Countdown

CVE-2026-16495 is a stored cross-site scripting vulnerability in the Countdown Timer – Widget Countdown WordPress plugin. It affects all versions from 3.0.0 up to and including 3.0.1. The vulnerability is due to insufficient input sanitization and output escaping of the 'redirect_url' shortcode attribute. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This can lead to partial confidentiality and integrity impacts but does not affect availability.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure and modification of content within the affected site context. There is no indication of availability impact. The vulnerability does not appear to be exploited in the wild at this time.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable plugin versions. Monitor for vendor updates to apply an official fix once released.