CVE-2026-107648: WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
An unauthenticated remote attacker can exploit the issue. No credentials or user interaction are required to submit the crafted input.
Which plugin versions are affected?
All versions of WP Sessions Time Monitoring Full Automatic up to and including 1.1.5 are affected.
What happens after malicious input is stored?
Arbitrary script can execute in the browser of a user who accesses the injected page. The reported impact includes exposure or modification of data available to that user’s browser context.