EUVD-2026-41285
GHSA-pqph-qhf9-37xc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-reachable XSS (AV:N/PR:N/AC:L) requiring victim interaction (UI:R); script runs in a different context (S:C) with limited browser-session confidentiality/integrity/availability impact (C:L/I:L/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
AnalysisAI
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N) but does require victim interaction (UI:R): the attacker must induce a user - ideally a logged-in WordPress administrator or staff member - to click a crafted link or load a page containing the injected payload targeting the Timetics plugin (versions ≤ 1.0.58). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, consistent with XSS rather than direct server compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL or booking-form input containing a malicious JavaScript payload aimed at a Timetics endpoint and delivers it to a site administrator or visitor via email, chat, or a malicious page. When the victim opens the link, the unsanitized input is rendered in their browser and the script executes, stealing session cookies, performing actions as the logged-in user, or redirecting to a phishing page. … |
| Remediation | Update the Timetics plugin to a version later than 1.0.58 once the vendor publishes a patched release; the input data does not specify an exact fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-58-cross-site-scripting-xss-vulnerability?_s_id=cve) and the Arraytics changelog to confirm the corrected version before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for Timetics plugin presence and document affected versions (≤1.0.58); disable the plugin immediately as a precautionary measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today