CVE-2026-16495: Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirecturl' Shortcode Attribute in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated to WordPress with Contributor-level access or higher. No user interaction is required from the attacker after they can submit the malicious shortcode attribute.
Which installations are affected?
Countdown Timer – Widget Countdown versions up to and including 3.0.1 are affected. The issue is in the redirect_url shortcode attribute.
What happens when exploitation succeeds?
An attacker can store arbitrary web scripts in a page using the vulnerable shortcode attribute. The script executes when another user accesses the injected page.