CVE-2026-107648 in WP Sessions Time Monitoring Full Automatic Plugin
Summary
by MITRE • 10/16/2026
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within the WP Sessions Time Monitoring Full Automatic plugin for WordPress, affecting all versions up to and including 1.1.5, represents a critical security flaw classified as Stored Cross-Site Scripting. This type of attack is particularly dangerous because it involves persisting malicious scripts on the target server rather than merely injecting them into a single session or URL parameter that requires immediate user interaction to trigger. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's codebase, specifically when handling data submitted through various POST parameters such as action, function, plugin, post_type, post_status, ids, loggedout, and post_title. Because these inputs are not properly validated or encoded before being stored in the database, they become a vector for persistent malicious content injection.
From an operational perspective, this flaw allows unauthenticated attackers to inject arbitrary web scripts into pages managed by the plugin. Unlike reflected XSS where the payload is executed only when a victim clicks a specially crafted link, stored XSS persists on the server side. Consequently, whenever any user accesses a page that contains the injected script, the malicious code executes in their browser context. This can lead to severe consequences including session hijacking, credential theft, defacement of the website, or redirection to phishing sites. The impact is amplified by the fact that no authentication is required to exploit this vulnerability, making it accessible to any internet user with basic knowledge of web exploitation techniques and automated scanning tools.
In terms of industry standards, this vulnerability aligns closely with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The specific nature of the attack where malicious scripts are stored in a database or file system for later execution corresponds to Stored XSS. Furthermore, within the MITRE ATT&CK framework, this behavior maps to techniques such as T1059: Command and Scripting Interpreter, specifically when used for client-side script injection like JavaScript. The lack of proper output encoding also relates to CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), highlighting the failure to sanitize special characters that could be interpreted as executable code by web browsers.
To mitigate this vulnerability, immediate action is required from website administrators and plugin developers. The most effective remediation step is to update the WP Sessions Time Monitoring Full Automatic plugin to version 1.1.6 or later, where these input validation and output escaping issues have been addressed. For sites unable to upgrade immediately due to compatibility constraints, temporary mitigations should include implementing a Web Application Firewall (WAF) that can detect and block XSS payloads in POST requests targeting the affected parameters. Additionally, developers must ensure that all user-supplied data is strictly sanitized using appropriate functions such as wp_kses_post or sanitize_text_field before storage, and escaped using esc_html or similar methods when outputting to HTML contexts. Regular security audits and code reviews focusing on input handling are essential to prevent recurrence of such flaws in WordPress ecosystems.