Activitytime Vulnerabilities

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with su...

CVSS:

6.5

Affected:

up to 1.1.4

Fixed in:

1.1.5

Disclosed:

Apr 20, 2026

CVE-2026-39581 on NVD →

The Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.1.3

Fixed in:

1.1.4

Disclosed:

Feb 15, 2026

CVE-2026-32362 on NVD →

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execu...

CVSS:

6.1

Affected:

up to 1.1.1

Fixed in:

1.1.2

Disclosed:

Jan 31, 2025

CVE-2025-24718 on NVD →

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to ap...

CVSS:

7.5

Affected:

up to 1.0.9

Fixed in:

1.1.0

Disclosed:

Oct 21, 2024

CVE-2024-49681 on NVD →

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection via request parameters in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unau...

CVSS:

9.8

Affected:

up to 1.0.8

Fixed in:

1.0.9

Disclosed:

Sep 11, 2023

CVE-2023-5203 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 1.0.6

Fixed in:

1.0.6

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →