CVE-2024-13864
Published: 11 March 2025
Summary
CVE-2024-13864 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Yaidier Countdown Timer. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13864 is a reflected cross-site scripting (XSS) vulnerability affecting the Countdown Timer WordPress plugin through version 1.0. The plugin fails to sanitize and escape a parameter before outputting it back in the page, enabling attackers to inject and execute malicious scripts. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).
The vulnerability can be exploited remotely by unauthenticated attackers with low complexity, requiring user interaction such as clicking a malicious link. It targets high-privilege users like administrators, allowing execution of arbitrary JavaScript in their browser context upon successful reflection, with changed scope and low impacts on confidentiality, integrity, and availability.
Mitigation details are available in the WPScan advisory at https://wpscan.com/vulnerability/b95b32b6-218a-4d02-b294-ab13458006b2/. Security practitioners should consult this reference for patch information, version updates, or workarounds specific to the Countdown Timer plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54186
Vulnerability details
The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables remote exploitation of the web application (T1190) and direct execution of attacker-supplied JavaScript in the victim's browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 requires filtering and escaping of information prior to output on web pages, directly preventing reflected XSS by neutralizing malicious scripts in the unsanitized plugin parameter.
SI-10 enforces validation of all information inputs, blocking malicious script payloads from being accepted and reflected by the Countdown Timer plugin.
SI-2 mandates identification, reporting, and correction of software flaws, enabling timely patching of the vulnerable WordPress plugin version through 1.0.