CVE-2026-107648

HighCVSS 7.2

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title) in all versions up to and including 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Risk Assessment

An unauthenticated attacker can inject persistent scripts into the WordPress site that execute in an administrator's or user's browser, enabling session theft, redirection, or content modification.

Recommendation

Update the WP Sessions Time Monitoring Full Automatic plugin to a version newer than 1.1.5 or disable it if no fix is available.

Other vulnerabilities in WP Sessions Time Monitoring Full Automatic

CVE-2026-39581High
The WP Sessions Time Monitoring Full Automatic plugin versions up to 1.1.4 is vulnerable to SQL Injection, allowing unauthorized users to access the database.

Original NVD description (English source)

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS