The All in One Time Clock Lite plugin for WordPress contains a reflected cross‑site scripting flaw that is triggered through the 'nonce' parameter. An attacker can insert malicious scripts that are reflected in the response when a specially crafted URL is accessed. Because the parameters are not properly sanitized or escaped, the injected code can run in the browsers of any user who follows the link, potentially exposing sensitive data, hijacking sessions, or injecting further malicious content.

All versions of the All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin, distributed by codebangers, up to and including 2.0 are affected. The plugin is distributed for WordPress sites and may be installed on any WordPress installation that uses these plugin versions.

The vulnerability receives a CVSS score of 6.1, indicating moderate severity. The EPSS score is below 1 %, reflecting a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers would need to craft a URL with a malicious nonce value and convince an unauthenticated user to click it. If successful, the reflected script runs in the victim’s browser, leading to potential data theft, session hijacking, or defacement. The risk is moderate but still warrants timely remediation.