What is the CVSS score of CVE-2026-57674?

CVE-2026-57674 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Timetics are affected by CVE-2026-57674?

The Timetics WordPress appointment-booking plugin (versions ≤1.0.58) contains a cross-site scripting vulnerability enabling unauthenticated attackers to inject malicious code into administrator and…

How to fix or mitigate CVE-2026-57674?

Within 24 hours: Audit all WordPress installations for Timetics plugin presence and document affected versions (≤1.0.58); disable the plugin immediately as a precautionary measure. Within 7 days: Replace Timetics with a maintained alternative appointment-booking plugin; reset all WordPress administrator account credentials; review web server logs for exploitation indicators (script injection in query strings or POST data). Within 30 days: Deploy Web Application Firewall rules with XSS detection signatures; implement Content Security Policy (CSP) headers; enforce multi-factor authentication on all administrator accounts; conduct staff training on phishing and malicious link risks.

Timetics CVE-2026-57674

EUVD-2026-41285 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-pqph-qhf9-37xc

WordPress XSS Wordpress Plugin Timetics Arraytics

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable XSS (AV:N/PR:N/AC:L) requiring victim interaction (UI:R); script runs in a different context (S:C) with limited browser-session confidentiality/integrity/availability impact (C:L/I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:28 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

AnalysisAI

Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.

Technical ContextAI

Timetics is a WordPress plugin (vendor Arraytics, CPE cpe:2.3:a:arraytics:timetics) used for appointment scheduling and booking. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is rendered into an HTML response without adequate output encoding or sanitization. In Patchstack-reported WordPress plugin cases this typically stems from a plugin endpoint or booking parameter that echoes attacker input into a page. The changed scope (S:C) in the CVSS vector indicates the injected script executes in a security context different from the vulnerable component - the browser DOM of any user who loads the poisoned content.

RemediationAI

Update the Timetics plugin to a version later than 1.0.58 once the vendor publishes a patched release; the input data does not specify an exact fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-58-cross-site-scripting-xss-vulnerability?_s_id=cve) and the Arraytics changelog to confirm the corrected version before deploying. Until a confirmed patch is applied, deploy a WAF/virtual-patching rule (for example Patchstack or Wordfence) to filter script-injection patterns on Timetics booking endpoints, and restrict or disable public access to the plugin's front-end booking pages if they are not business-critical - noting this breaks customer-facing self-service booking. Enforcing a restrictive Content-Security-Policy that disallows inline script execution further reduces reflected-payload impact, at the cost of potentially breaking legitimate inline scripts on the site.