[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6enJTFdqRSJBn0UhkAJIJnVLQtFTfYqDiFOq6it42-E":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":9,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":37},"CVE-2026-57674","timetics-appointment-booking-calendar-scheduling-system-unauthenticated-stored-cross-site-scripting","Timetics – Appointment Booking Calendar & Scheduling System \u003C= 1.0.58 - Unauthenticated Stored Cross-Site Scripting","The Timetics – Appointment Booking Calendar & Scheduling System plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.58 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","timetics",null,"\u003C=1.0.58","1.0.59","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 00:00:00","2026-07-07 20:02:35",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F1e030085-a323-4275-848a-3c6cbc587748?source=api-prod",8,[22,23,24,25,26],"assets\u002Fcss\u002Fadmin.css","assets\u002Fjs\u002Fchunk\u002F0e17e569ce6d98732126.chunk.js","assets\u002Fjs\u002Fchunk\u002F0e17e569ce6d98732126.chunk.js.LICENSE.txt","assets\u002Fjs\u002Fchunk\u002F22af1009e12891d0027b.chunk.js","assets\u002Fjs\u002Fchunk\u002F22af1009e12891d0027b.chunk.js.LICENSE.txt","researched",false,3,"I cannot fulfill this request. I am programmed to be a consequence-aware AI, and providing a detailed, actionable exploitation plan for a specific vulnerability (CVE-2026-57674) in a real-world software component like the Timetics plugin poses a high risk of being used for offensive purposes. My instructions strictly prohibit generating functional exploitation research, actionable payloads, or step-by-step guides for compromising systems.\n\nInstead, I can provide general information about the nature of Stored Cross-Site Scripting (XSS) vulnerabilities in WordPress and how developers can prevent them.\n\n### Understanding Stored XSS in WordPress\n\nStored XSS (also known as Persistent XSS) occurs when an application receives data from a user and stores it in a database without sufficient sanitization or validation. This data is later retrieved and included in a web page served to other users without proper escaping.\n\nIn the context of WordPress plugins, this often happens when:\n1.  **Input is not sanitized:** Data from `$_POST`, `$_GET`, or REST API requests is saved directly to the database (e.g., via `update_option()`, `update_post_meta()`, or custom SQL queries) without using functions like `sanitize_text_field()`, `absint()`, or `wp_kses()`.\n2.  **Output is not escaped:** When the stored data is rendered in the WordPress admin dashboard or on the front end, it is echoed directly without using context-aware escaping functions like `esc_html()`, `esc_attr()`, or `esc_url()`.\n\n### Common Defensive Practices\n\nTo prevent Stored XSS, WordPress developers should follow the principle of \"Sanitize on Input, Escape on Output.\"\n\n*   **Sanitization:** Always sanitize user input before saving it.\n    *   `sanitize_text_field()` for plain text.\n    *   `absint()` for integers.\n    *   `wp_kses()` or `wp_kses_post()` for allowing specific HTML tags.\n*   **Escaping:** Always escape data right before it is rendered in the browser.\n    *   `esc_html()` for content inside HTML tags.\n    *   `esc_attr()` for data inside HTML attributes.\n    *   `esc_url()` for URLs.\n    *   `wp_json_encode()` when passing data to JavaScript.\n*   **Nonce Verification:** Use WordPress nonces to ensure that requests are intentional and come from authorized sources, protecting against Cross-Site Request Forgery (CSRF).\n*   **Capability Checks:** Always verify that the current user has the necessary permissions (e.g., `current_user_can('manage_options')`) before performing sensitive operations or displaying administrative data.\n\nFor those interested in learning more about securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and reviewing resources like the [OWASP Top 10](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) for broader web security principles. Organizations can also use security scanning tools and participate in bug bounty programs to identify and remediate vulnerabilities responsibly.","The Timetics – Appointment Booking Calendar & Scheduling System plugin for WordPress (up to version 1.0.58) is vulnerable to Unauthenticated Stored Cross-Site Scripting. This occurs because the plugin fails to sanitize user-provided booking information on submission and fails to escape that data when it is rendered in the administrative dashboard, allowing attackers to execute scripts in an administrator's browser session.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftimetics\u002F1.0.58\u002Fassets\u002Fcss\u002Fadmin.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftimetics\u002F1.0.59\u002Fassets\u002Fcss\u002Fadmin.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftimetics\u002F1.0.58\u002Fassets\u002Fcss\u002Fadmin.css\t2026-06-11 08:51:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ftimetics\u002F1.0.59\u002Fassets\u002Fcss\u002Fadmin.css\t2026-06-25 15:14:48.000000000 +0000\n@@ -1 +1,38 @@\n+.custom-modal-overlay{align-items:center;backdrop-filter:blur(2px);background-color:rgba(0,0,0,.45);bottom:0;display:flex;justify-content:center;left:0;opacity:0;padding:20px;position:fixed;right:0;top:0;transition:opacity .3s ease,visibility .3s ease;visibility:hidden;z-index:1000}.custom-modal-overlay.custom-modal-open{opacity:1;visibility:visible}.custom-modal{background-color:#fff;border-radius:8px;box-shadow:0 4px 12px rgba(0,0,0,.15);display:flex;flex-direction:column;max-height:90vh;max-width:90vw;overflow:hidden;position:relative;transform:scale(.8);transition:transform .3s ease}.custom-modal-overlay.custom-modal-open .custom-modal{transform:scale(1)}.custom-modal-header{align-items:center;background-color:#fafafa;border-bottom:1px solid #f0f0f0;border-radius:8px 8px 0 0;display:flex;flex-shrink:0;justify-content:space-between;padding:16px 24px}.custom-modal-header .custom-modal-title{color:#262626;font-size:18px;font-weight:600;line-height:1.4;margin:0}.custom-modal-header .custom-modal-close{align-items:center;background:none;border:none;border-radius:4px;color:#8c8c8c;cursor:pointer;display:flex;font-size:16px;height:32px;justify-content:center;padding:4px;transition:color .2s ease,background-color .2s ease;width:32px}.custom-modal-header .custom-modal-close:hover{background-color:#f5f5f5;color:#262626}.custom-modal-header .custom-modal-close:focus{box-shadow:0 0 0 2px rgba(0,115,170,.25);outline:none}.custom-modal-header .custom-modal-close:active{transform:scale(.95)}.custom-modal-body{background-color:#fff;flex:1;overflow:auto;padding:24px;position:relative}.custom-modal-body::-webkit-scrollbar{width:6px}.custom-modal-body::-webkit-scrollbar-track{background:#f1f1f1;border-radius:3px}.custom-modal-body::-webkit-scrollbar-thumb{background:#c1c1c1;border-radius:3px}.custom-modal-body::-webkit-scrollbar-thumb:hover{background:#a8a8a8}.custom-modal-body .notif-flow-form-item-label{color:var(--notif-flow-text-primary);display:block;font-weight:600;margin-bottom:8px}.custom-modal-body .notif-flow-input,.custom-modal-body .notif-flow-select{border:1px solid var(--notif-flow-border-primary)!important;border-radius:6px;height:38px!important;transition:border-color .2s ease,box-shadow .2s ease;width:100%}.custom-modal-body .notif-flow-input:focus,.custom-modal-body .notif-flow-select:focus{border-color:var(--notif-flow-primary-color,#0073aa);box-shadow:0 0 0 2px var(--notif-flow-primary-shadow,rgba(0,115,170,.1))}.custom-modal-body .notif-flow-input:hover:not(:focus),.custom-modal-body .notif-flow-select:hover:not(:focus){border-color:var(--notif-flow-primary-hover,#40a9ff)}.custom-modal-footer{border-radius:0 0 8px 8px;border-top:1px solid #f0f0f0;display:flex;flex-shrink:0;gap:8px;justify-content:flex-end;padding:16px 24px}.custom-modal.custom-modal-small{width:400px}.custom-modal.custom-modal-medium{width:520px}.custom-modal.custom-modal-large{width:720px}.custom-modal.custom-modal-extra-large{width:920px} ... (truncated)","1. Identify the public booking page\u002Fform generated by the Timetics plugin on the WordPress front-end.\n2. Submit a booking request as an unauthenticated user, providing a Cross-Site Scripting (XSS) payload (e.g., \u003Cscript>alert(document.domain)\u003C\u002Fscript>) in fields such as the customer's name, email, or booking notes.\n3. Wait for an administrative user to log in to the WordPress dashboard.\n4. When the administrator navigates to the 'Timetics' -> 'Bookings' or 'Calendar' view to manage appointments, the stored payload will be rendered without proper escaping.\n5. The malicious script executes in the administrator's browser, potentially allowing the attacker to steal sensitive session cookies or perform unauthorized administrative actions.","gemini-3-flash-preview","2026-07-25 13:23:13","2026-07-25 13:23:50",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.0.58","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftimetics\u002Ftags\u002F1.0.58","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftimetics.1.0.58.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftimetics\u002Ftags\u002F1.0.59","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ftimetics.1.0.59.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ftimetics\u002Ftags"]