Security readout for executives and security teams
Plain-English summary
This WordPress plugin flaw lets a contributor-level user store malicious script through countdown shortcode attributes. If an affected page is viewed, the script may run in another user's browser. The issue is medium severity because it requires an authenticated low-privilege author and user interaction, but it can affect site visitors or admins viewing content.
Executive priority
Treat as a targeted medium-priority WordPress content risk. Prioritize sites with many contributors, public publishing workflows, or privileged admins reviewing contributor content. Patch or disable promptly, but this is not supported as an internet-wide emergency by the provided evidence.
Technical view
CVE-2023-0171 is CWE-79 stored XSS in jQuery T(-) Countdown Widget before 2.3.24. The plugin failed to validate and escape some shortcode attributes before rendering them in posts or pages. CVSS 3.1 is 5.4: network reachable, low complexity, low privileges required, user interaction required, changed scope.
Likely exposure
Exposure is limited to WordPress sites running jQuery T(-) Countdown Widget before 2.3.24, especially where contributor or higher roles can create content using the plugin shortcode. Sites without this plugin, or already on 2.3.24 or later, are not indicated as affected by the provided sources.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. WPScan is tagged with exploit and technical details, meaning defenders should assume public knowledge exists, but active exploitation should not be claimed from these sources alone.
Researcher notes
The affected range is described as plugin versions before 2.3.24. The public record identifies shortcode attribute validation and output escaping as the root issue. Evidence is incomplete on exploit prevalence, vendor identity, and post-fix code details, so validation should focus on installed version and content exposure.
Mitigation direction
- Upgrade jQuery T(-) Countdown Widget to version 2.3.24 or later.
- Disable or remove the plugin if an update is unavailable.
- Restrict contributor access to shortcode-capable content until remediated.
- Review contributor-authored posts and pages using countdown shortcodes.
- Follow vendor or WordPress plugin guidance for any additional remediation.
Validation and detection
- Inventory WordPress sites for the jQuery T(-) Countdown Widget plugin.
- Confirm the installed plugin version is 2.3.24 or later.
- Search content for countdown shortcodes authored by contributor-level users.
- Review rendered pages for unexpected script execution indicators.
- Check logs and admin activity around affected posts or pages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-0171 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/32324655-ff91-4a53-a2c5-ebe6678d4a9dCVE reference · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.