Timetics EUVD-2026-41285

Exploitation requires no authentication (PR:N) but does require victim interaction (UI:R): the attacker must induce a user - ideally a logged-in WordPress administrator or staff member - to click a crafted link or load a page containing the injected payload targeting the Timetics plugin (versions ≤ 1.0.58). The vulnerable code path lives in the Timetics plugin, so the plugin must be installed and its affected input/endpoint reachable; sites not running Timetics, or running a version newer than 1.0.58, are unaffected. Limiting factors: the mandatory user-interaction step prevents fully automated mass exploitation, and impact scales with the privilege of the victim who triggers the payload.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, consistent with XSS rather than direct server compromise. The user-interaction requirement (UI:R) meaningfully limits automatability: an attacker must lure a victim to crafted content. No EPSS probability was supplied, the CVE is not in CISA KEV, and no proof-of-concept is referenced, so there is no evidence of active or widespread exploitation. Net assessment: a genuine but moderate-priority issue whose realistic impact is session/credential theft or forged admin actions against WordPress users, gated by social engineering rather than mass automation. No signals conflict, but the missing EPSS and unknown POC status leave exploitation likelihood only partially characterized.

An attacker crafts a URL or booking-form input containing a malicious JavaScript payload aimed at a Timetics endpoint and delivers it to a site administrator or visitor via email, chat, or a malicious page. When the victim opens the link, the unsanitized input is rendered in their browser and the script executes, stealing session cookies, performing actions as the logged-in user, or redirecting to a phishing page. No proof-of-concept is referenced, and exploitation depends on the victim interacting with the crafted content (UI:R).