CVE-2026-16495: WordPress Countdown Timer Widget XSS Flaw

CVE-2026-16495 Overview

CVE-2026-16495 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Countdown Timer – Widget Countdown plugin for WordPress. The flaw affects all versions up to and including 3.0.1. It stems from insufficient input sanitization and output escaping on the redirect_url shortcode attribute. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who views an affected page.

Critical Impact

Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, forced redirects, and account takeover of higher-privileged users.

Affected Products

• WordPress Countdown Timer – Widget Countdown plugin
• All plugin versions up to and including 3.0.1
• WordPress sites allowing contributor-level accounts

Discovery Timeline

• 2026-10-14 - CVE-2026-16495 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-16495

Vulnerability Analysis

The Countdown Timer – Widget Countdown plugin exposes a shortcode that accepts a redirect_url attribute. The plugin passes the attribute value into page output without sufficient sanitization or escaping. An attacker with contributor privileges can embed the shortcode in a post and supply a crafted redirect_url value containing JavaScript payloads or event handlers. When the post is rendered, the browser executes the injected script in the context of the WordPress site. The vulnerable code path resides in the plugin's legacy front-end handler at includes/legacy/front_end.php around line 169.

Root Cause

The root cause is missing input validation on the redirect_url shortcode attribute combined with absent output escaping when the value is rendered to HTML. WordPress provides sanitization helpers such as esc_url() and esc_attr() for this exact scenario, but the plugin omits them for this attribute. The result is a stored injection sink reachable through normal content creation workflows.

Attack Vector

Exploitation requires an authenticated session with contributor-level permissions or higher. The attacker creates or edits a post containing the countdown shortcode with a malicious redirect_url value. After the content is published or previewed, any user loading the page triggers script execution. Because scope is Changed in the CVSS vector, the payload executes in the context of the WordPress origin and can target administrator sessions, scraping nonces, hijacking cookies, or performing authenticated actions through forced requests.

See the WordPress plugin source reference and the Wordfence Vulnerability Report for the vulnerable code path and advisory details.

Detection Methods for CVE-2026-16495

Indicators of Compromise

• Posts or pages containing the countdown shortcode with redirect_url values that include <script>, javascript:, or event handler attributes such as onerror= or onload=.
• Unexpected outbound redirects from pages hosting the countdown widget.
• Contributor or author accounts creating or editing content outside of normal patterns.

Detection Strategies

• Query the WordPress wp_posts table for post_content containing the countdown shortcode combined with suspicious redirect_url attribute values.
• Review web server access logs for requests to pages containing the plugin shortcode followed by anomalous third-party domain requests.
• Monitor browser Content Security Policy (CSP) violation reports for inline script execution originating from plugin-rendered pages.

Monitoring Recommendations

• Audit newly created contributor and author accounts and their published content.
• Alert on edits to published posts that introduce shortcodes with URL-type attributes containing non-HTTP schemes.
• Track plugin version inventory across managed WordPress deployments to confirm patch status for the Widget Countdown plugin.

How to Mitigate CVE-2026-16495

Immediate Actions Required

• Update the Countdown Timer – Widget Countdown plugin to the latest version above 3.0.1 once released by the vendor.
• Audit existing posts and pages for countdown shortcodes containing suspicious redirect_url values and remove any malicious entries.
• Review contributor-level and higher accounts, disabling any that are inactive or unrecognized.

Patch Information

No patched version is referenced in the NVD record at publication. Monitor the WordPress plugin repository for Widget Countdown and the Wordfence advisory for the fixed release. Apply the vendor update as soon as it becomes available.

Workarounds

• Deactivate the Countdown Timer – Widget Countdown plugin until a patched version is available.
• Restrict contributor and author roles to trusted users and enforce content review before publication.
• Deploy a Web Application Firewall (WAF) rule that blocks shortcode attribute values containing javascript: schemes or HTML event handlers.
• Implement a strict Content Security Policy (CSP) that disallows inline scripts to limit the impact of stored XSS payloads.

# Example CSP header to reduce stored XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"