Contributor-level stored XSS via countdown redirect URL
Published Feb 26, 2025 · Updated Feb 26, 2025
Stored XSS in FlickDevs Countdown Timer for Elementor before 1.3.7 allows remote authenticated users to execute script in visitors' browsers. The Countdown Expire widget accepts a javascript URL in the Redirect On field and emits it into the page without sanitization or escaping, so expiry navigates a visitor to attacker-supplied script. Contributor access is sufficient to create the crafted timer, and execution requires a visitor to view the page and wait until the countdown reaches zero.
Summary
What happened
Stored XSS in FlickDevs Countdown Timer for Elementor before 1.3.7 allows remote authenticated users to execute script in visitors' browsers. The Countdown Expire widget accepts a javascript URL in the Redirect On field and emits it into the page without sanitization or escaping, so expiry navigates a visitor to attacker-supplied script. Contributor access is sufficient to create the crafted timer, and execution requires a visitor to view the page and wait until the countdown reaches zero.
The record
- CVE
- CVE-2024-13113
- Published
- Feb 26, 2025
- Updated
- Feb 26, 2025
- Vendor
- FlickDevs
- Product
- Countdown Timer for Elementor
- Classifications
- CWE-79, T1059.007
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- Feb 26, 2025CVE publishedPublication date reported by the CVE source.
- Feb 26, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <1.3.7
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- Countdown Expire redirect proof of conceptproof of concept · validated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo