CVE-2024-13864

Countdown Timer <= 1.0 - Reflected XSS

The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

We have discovered 1 live websites that are affected by CVE-2024-13864.

Run a Free Instant Scan



Affected Software

Product  Countdown Timer
Category Wordpress Plugins
Vulnerable Domains1 live websites (0.20% of Countdown Timer install base)
Vulnerable Versions
  • from 0 through 1
Vulnerable Versions Count0 versions ( less than 0.1% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Mar 11, 2025
  • Updated - Mar 11, 2025

Credits

  • Hassan Khan Yusufzai - Splint3r7 (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2024-13864
Russia1 websites

Website Distribution by TLD

Number of websites using CVE-2024-13864
.ru1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-13864

Top websites that are affected by CVE-2024-13864. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.ru Russia**,***,***
See full domain list

FAQ

CVE-2024-13864 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Countdown Timer
A total of 1 websites have been identified as vulnerable to CVE-2024-13864, based on global website indexing conducted by WebTechSurvey.
The Countdown Timer is affected by the CVE-2024-13864 vulnerability.
Countdown Timer versions up to and including 1 are vulnerable to CVE-2024-13864.