Description
Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
Published: 2026-07-02
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Timetics WordPress plugin, versions 1.0.58 and earlier, contains an unauthenticated Cross‑Site Scripting vulnerability that allows the injection of arbitrary JavaScript into the output rendered to visitors. This flaw is catalogued as CWE‑79 and can be exploited without authentication, enabling attackers to execute code in the context of any user viewing affected pages.

Affected Systems

WordPress installations that utilize the Timetics plugin from Arraytics, specifically those running version 1.0.58 or earlier. The vendor recommends applying version 1.0.59 or newer to remove the vulnerability.

Risk and Exploitability

The flaw is scored 7.1 on the CVSS scale, indicating high severity. Its EPSS score is listed as < 1 %, showing a very low but non‑zero probability of exploitation, and it is not currently in the CISA KEV catalog. Attackers can leverage the unauthenticated vector by crafting a malicious URL or input that is reflected back into the page, causing arbitrary JavaScript to run in the victim’s browser.

Generated by OpenCVE AI on July 21, 2026 at 11:42 UTC.

Remediation

Vendor Solution

Update the WordPress Timetics Plugin to the latest available version (at least 1.0.59).

OpenCVE Recommended Actions

  • Upgrade the Timetics Plugin to version 1.0.59 or newer.
  • Remove or disable unused Timetics widget instances to eliminate legacy XSS code.
  • Apply a Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.

Generated by OpenCVE AI on July 21, 2026 at 11:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Arraytics
Arraytics timetics
Wordpress
Wordpress wordpress
Vendors & Products Arraytics
Arraytics timetics
Wordpress
Wordpress wordpress

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
Title WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Arraytics Timetics
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T19:45:09.915Z

Reserved: 2026-06-25T08:03:37.652Z

Link: CVE-2026-57674

cve-icon Vulnrichment

Updated: 2026-07-02T19:45:01.552Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T11:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')