CVE-2026-107648Published
WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107648 · Microsoft / collected KEV context
cve-program · CVE-2026-107648
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9edc25d5-10a0-4d5c-aa29-41fad5e29ae9?source=cve
- https://plugins.trac.wordpress.org/browser/activitytime/trunk/application/views/actt_current_active/index.php#L244
- https://plugins.trac.wordpress.org/browser/activitytime/trunk/application/controllers/Actt_current_active.php#L104
- https://plugins.trac.wordpress.org/browser/activitytime/trunk/includes/class-activitytime-tracker.php#L160
- https://plugins.trac.wordpress.org/browser/activitytime/trunk/includes/helper-functions.php#L340
- https://plugins.trac.wordpress.org/browser/activitytime/trunk/vendor/Winter_MVC/core/helpers.php#L1139
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.