8.8 High

CVE-2021-34636 The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the…

Description

The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.

Affected products and versions

Product	Affected versions	Fixed in
Countdown and CountUp, WooCommerce Sales Timers	1.5.7	No fix stated

Do you use Countdown and CountUp, WooCommerce Sales Timers?

Track this CVE Watch Countdown and CountUp, WooCommerce Sales Timers Check my SBOMs

www.cveye.io/en/cve/CVE-2021-34636

Timeline

Published September 28, 2021
Last modified March 31, 2025

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE