CVE-2021-34636

Name of the Vulnerable Software and Affected Versions: The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin versions up to and including 1.5.7

Description: The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the save theme function found in the ~/includes/admin/coundown theme page.php file. This allows attackers to inject arbitrary web scripts.

Recommendations: For versions up to and including 1.5.7, update to a version that includes a fix for this issue. As a temporary workaround, consider disabling the save theme function until a patch is available. Restrict access to the ~/includes/admin/coundown theme page.php file to minimize the risk of exploitation.