The WP Sessions Time Monitoring Full Automatic plugin contains a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into the site's pages via the 'action' GET parameter and related parameters. An unauthenticated user can embed code that will execute in the browsers of any visitor who views the affected pages, enabling session hijacking, cookie theft, defacement, or phishing attacks. This weakness is identified as CWE‑79 and does not require authentication or privileged access.

Vulnerable systems are WordPress sites that have the switcorp WP Sessions Time Monitoring Full Automatic plugin installed in any version up to and including 1.1.5. No later version of the plugin is listed as affected.

The CVSS score of 7.2 indicates a high severity vulnerability. Because the exploit only requires an unauthenticated user to provide a specially crafted URL, the attack vector is high and exploitation is trivial. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the lack of authentication requirement and lack of input validation make it a practical threat for active attackers. An attacker can simply craft a URL containing unsafe JavaScript and get it delivered to site visitors.