The vulnerability allows an attacker to inject malicious JavaScript into the Time Clock plugin’s web pages, which is then stored and rendered to any visitor of the site. This stored XSS can lead to cookie theft, session hijacking, defacement or redirection of site visitors. The weakness is identified as CWE‑79, indicating improper input sanitization.

The flaw affects the Scott Paterson Time Clock plugin for WordPress versions up to and including 1.2.3, with no sub‑version detail provided.

The CVSS score of 5.9 classifies the issue as medium severity. The EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is web‑based; an attacker must be able to insert malicious content into the plugin’s input fields—typically via the administrative interface—before administrators or users trigger the vulnerable page. The impact is confined to the victim’s browser session, but the stored nature of the flaw means the payload can affect all users who view the compromised content.