CVE-2025-8445: Countdown Timer for Elementor XSS Flaw

CVE-2025-8445 Overview

The Countdown Timer for Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the countdown_label parameter. The flaw affects all plugin versions up to and including 1.3.9. It stems from insufficient input sanitization and output escaping in the countdown timer widget. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browsers of any users who view the affected pages. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative account takeover, and drive-by redirection of site visitors.

Affected Products

Countdown Timer for Elementor plugin for WordPress, versions up through 1.3.9
WordPress sites running the Elementor page builder with this plugin installed
Any site permitting Contributor-level or higher user registration with the plugin enabled

Discovery Timeline

2025-09-11 - CVE-2025-8445 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8445

Vulnerability Analysis

The vulnerability resides in the countdown timer widget shipped with the plugin. The widget accepts a countdown_label parameter that renders directly into page output. The plugin fails to sanitize input on save and does not escape output during rendering. An authenticated attacker with Contributor privileges can supply HTML and JavaScript payloads in this field. When any visitor loads the containing page, the browser executes the stored payload in the site's origin.

Stored XSS in a Contributor-accessible field is impactful because Contributors normally cannot publish content or upload arbitrary HTML. The plugin effectively grants them a path to persist executable script. Payloads can hijack administrator sessions, exfiltrate cookies, mint new admin accounts through the REST API, or backdoor site templates.

Root Cause

The plugin's widget renderer emits the countdown_label value into the DOM without applying WordPress escaping functions such as esc_html() or wp_kses_post(). Input handling on save also omits sanitization callbacks. The relevant rendering logic is visible in the plugin source at line 513 of countdown-timer-widget.php.

Attack Vector

An attacker authenticates to the target WordPress site as a Contributor or higher-privileged user. The attacker creates or edits a post containing a Countdown Timer for Elementor widget and places a script payload into the countdown_label field. After the post is saved and later viewed, whether in preview, on the front end, or after publication by an editor, the payload executes in the viewer's browser context. See the Wordfence advisory for further technical detail.

Detection Methods for CVE-2025-8445

Indicators of Compromise

Elementor widget data containing <script> tags, on* event handlers, or javascript: URIs within the countdown_label field stored in wp_postmeta
Unexpected creation of administrator accounts or REST API calls to /wp-json/wp/v2/users shortly after Contributor logins
Outbound requests from visitor browsers to attacker-controlled domains sourced from pages containing the countdown timer widget

Detection Strategies

Query the wp_postmeta table for Elementor _elementor_data entries containing countdown_label values with HTML control characters or script markers
Monitor web server logs for POST requests to /wp-admin/admin-ajax.php or the block editor endpoints originating from Contributor accounts followed by anomalous admin activity
Deploy Content Security Policy (CSP) reporting to surface inline script violations on pages rendering Elementor widgets

Monitoring Recommendations

Alert on new WordPress user creation, role escalation, and plugin or theme file modifications following Contributor activity
Track auditable changes to Elementor page templates that include the countdown timer widget
Correlate WordPress access logs with browser telemetry to identify visitors receiving unexpected script payloads

How to Mitigate CVE-2025-8445

Immediate Actions Required

Update the Countdown Timer for Elementor plugin to a version above 1.3.9 once the vendor releases a patched build
Audit existing posts and pages for Countdown Timer widgets and inspect countdown_label values for injected markup
Review Contributor and Author accounts for legitimacy and reset credentials for any accounts showing suspicious activity

Patch Information

At the time of publication, all versions up to and including 1.3.9 are affected. Site owners should monitor the WordPress plugin repository for a fixed release and apply it immediately. Verify the fix by confirming the plugin's widget renderer escapes the countdown_label output using esc_html() or an equivalent WordPress escaping function.

Workarounds

Deactivate the Countdown Timer for Elementor plugin until a patched version is available
Restrict user registration and revoke Contributor-and-above privileges from untrusted accounts
Deploy a web application firewall rule that blocks HTML tags and event handler attributes in Elementor widget submissions
Enforce a strict Content Security Policy that disallows inline scripts on pages built with Elementor

bash

# Temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate countdown-timer-for-elementor

# Search post metadata for suspicious countdown_label values
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = '_elementor_data' \
  AND (meta_value LIKE '%countdown_label%<script%' \
       OR meta_value LIKE '%countdown_label%onerror=%' \
       OR meta_value LIKE '%countdown_label%javascript:%');"