CVE-2024-13864
Published: 11 March 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2024-13864 is a reflected cross-site scripting (XSS) vulnerability affecting the Countdown Timer WordPress plugin through version 1.0. The plugin fails to sanitize and escape a parameter before outputting it back in the page, enabling attackers to inject and execute malicious scripts. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).
The vulnerability can be exploited remotely by unauthenticated attackers with low complexity, requiring user interaction such as clicking a malicious link. It targets high-privilege users like administrators, allowing execution of arbitrary JavaScript in their browser context upon successful reflection, with changed scope and low impacts on confidentiality, integrity, and availability.
Mitigation details are available in the WPScan advisory at https://wpscan.com/vulnerability/b95b32b6-218a-4d02-b294-ab13458006b2/. Security practitioners should consult this reference for patch information, version updates, or workarounds specific to the Countdown Timer plugin.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables remote exploitation of the web application (T1190) and direct execution of attacker-supplied JavaScript in the victim's browser context (T1059.007).