{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wp-sessions-time-monitoring-full-automatic--1.1.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp_sessions_time_monitoring_full_automatic_project:wp_sessions_time_monitoring_full_automatic:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-107648"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Sessions Time Monitoring Full Automatic (\u003c= 1.1.5)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","wordpress","xss"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe WP Sessions Time Monitoring Full Automatic plugin for WordPress (all versions up to and including 1.1.5) contains a critical security flaw involving insufficient input sanitization and output escaping. This vulnerability allows an unauthenticated attacker to perform Stored Cross-Site Scripting (XSS) attacks by injecting malicious JavaScript via various input parameters, including 'action', 'function', 'plugin', 'post_type', 'post_status', 'ids', 'loggedout', and 'post_title'.\u003c/p\u003e\n\u003cp\u003eWhen an administrative user or a logged-in user views a page where the attacker has successfully stored this malicious script, the code executes within the victim's browser session. This can lead to unauthorized account actions, session hijacking, or the defacement of the affected WordPress site. Because the vulnerability is exploitable by unauthenticated attackers, it represents a significant risk to site integrity and administrative session security.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a target WordPress site running the WP Sessions Time Monitoring Full Automatic plugin version 1.1.5 or earlier.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST or GET request targeting the vulnerable endpoints within the plugin.\u003c/li\u003e\n\u003cli\u003eThe attacker injects a persistent JavaScript payload into one of the susceptible parameters: 'action', 'function', 'plugin', 'post_type', 'post_status', 'ids', 'loggedout', or 'post_title'.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to sanitize the input and stores the script directly into the WordPress database.\u003c/li\u003e\n\u003cli\u003eThe attacker waits for an authenticated administrator or user to navigate to the specific page or dashboard area that renders the malicious entry.\u003c/li\u003e\n\u003cli\u003eThe victim's browser retrieves the stored payload from the database and executes the JavaScript in the context of the active session.\u003c/li\u003e\n\u003cli\u003eThe script performs unauthorized actions on behalf of the victim or exfiltrates session cookies to an attacker-controlled server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of site administrators. This can lead to full administrative account takeover, modification of site content, installation of additional backdoors via the WordPress admin panel, or theft of sensitive user data. As of the report date, all installations using version 1.1.5 or earlier are considered vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the \u0026quot;WP Sessions Time Monitoring Full Automatic\u0026quot; plugin to the latest version, ensuring the patch is applied for CVE-2026-107648.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests containing script-related characters such as \u003ccode\u003e\u0026lt;script\u003c/code\u003e, \u003ccode\u003eonerror=\u003c/code\u003e, or \u003ccode\u003eonload=\u003c/code\u003e within the identified vulnerable parameters.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to restrict the execution of inline scripts and mitigate the impact of stored XSS vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T12:26:22Z","date_published":"2026-10-16T12:26:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-sessions-xss/","summary":"The WP Sessions Time Monitoring Full Automatic WordPress plugin up to version 1.1.5 is vulnerable to stored XSS via multiple input parameters, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.","title":"Stored Cross-Site Scripting in WP Sessions Time Monitoring Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-sessions-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Sessions Time Monitoring Full Automatic (\u003c= 1.1.5)","version":"https://jsonfeed.org/version/1.1"}