The plugin contains an improper input sanitization flaw that allows arbitrary JavaScript code to be reflected in the generated web page. An attacker can craft a malicious request that includes script payloads, which will be executed in the context of any user that views the response. The vulnerability does not require authentication and can be triggered through normal browsing, making it exploitable to carry out cookie theft, session hijack or other client‑side attacks.

WordPress sites that use the WP Sessions Time Monitoring Full Automatic plugin from activity‑log.com. Versions from the initial release through 1.1.1 are vulnerable; any installation using versions 1.1.1 or earlier is affected.

The CVSS score of 7.1 reflects moderate–high severity; the EPSS score under 1% indicates a low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. The flaw is a classic reflected XSS scenario, typically triggered by sending a specially crafted URL or form input to a public webpage. Attackers would rely on victim curiosity or by embedding the malicious link in emails or on third‑party sites, gaining the ability to run code in the victim’s browser context.