Stored Cross-Site Scripting in WP Sessions Time Monitoring Plugin

The WP Sessions Time Monitoring Full Automatic plugin for WordPress (all versions up to and including 1.1.5) contains a critical security flaw involving insufficient input sanitization and output escaping. This vulnerability allows an unauthenticated attacker to perform Stored Cross-Site Scripting (XSS) attacks by injecting malicious JavaScript via various input parameters, including 'action', 'function', 'plugin', 'post_type', 'post_status', 'ids', 'loggedout', and 'post_title'.

When an administrative user or a logged-in user views a page where the attacker has successfully stored this malicious script, the code executes within the victim's browser session. This can lead to unauthorized account actions, session hijacking, or the defacement of the affected WordPress site. Because the vulnerability is exploitable by unauthenticated attackers, it represents a significant risk to site integrity and administrative session security.

Attack Chain

1. An unauthenticated attacker identifies a target WordPress site running the WP Sessions Time Monitoring Full Automatic plugin version 1.1.5 or earlier.
2. The attacker crafts a malicious HTTP POST or GET request targeting the vulnerable endpoints within the plugin.
3. The attacker injects a persistent JavaScript payload into one of the susceptible parameters: 'action', 'function', 'plugin', 'post_type', 'post_status', 'ids', 'loggedout', or 'post_title'.
4. The plugin fails to sanitize the input and stores the script directly into the WordPress database.
5. The attacker waits for an authenticated administrator or user to navigate to the specific page or dashboard area that renders the malicious entry.
6. The victim's browser retrieves the stored payload from the database and executes the JavaScript in the context of the active session.
7. The script performs unauthorized actions on behalf of the victim or exfiltrates session cookies to an attacker-controlled server.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of site administrators. This can lead to full administrative account takeover, modification of site content, installation of additional backdoors via the WordPress admin panel, or theft of sensitive user data. As of the report date, all installations using version 1.1.5 or earlier are considered vulnerable.

Recommendation

• Immediately update the "WP Sessions Time Monitoring Full Automatic" plugin to the latest version, ensuring the patch is applied for CVE-2026-107648.
• Monitor web server access logs for anomalous POST requests containing script-related characters such as <script, onerror=, or onload= within the identified vulnerable parameters.
• Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and mitigate the impact of stored XSS vulnerabilities.