CVE-2026-57674
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Timetics plugin version 1.0.58 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Risk Assessment
The risk involves potential execution of arbitrary JavaScript in users' browsers, which can lead to session theft, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Timetics plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in Timetics
See all- CVE-2026-116860Medium
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.65.
- CVE-2026-97304Medium
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
- CVE-2026-84215Medium
The Timetics plugin versions up to 1.0.61 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS