Wpdevart Countdown Timer – Widget Countdown vulnerabilities

2 CVEs affecting Wpdevart Countdown Timer – Widget Countdown, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16495, published 2026-10-14.

More from Wpdevart.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-14555, published 2026-01-10. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevart_countdown' shortcode in all versions up to, and including, 2.7.7…
• CVE-2026-16495, published 2026-10-14. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to, and including, 3.0.1 due to…