All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier [aio-time-clock-lite] < 2.0.4
unknown
[en] The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce c...
- Affected:
- up to 2.0.4
- Fixed in:
- 2.0.4
- Disclosed:
- Nov 4, 2025
CVE-2025-11758 on NVD →
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure
medium
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check...
- CVSS:
- 6.5
- Affected:
- up to 2.0.3
- Fixed in:
- 2.0.4
- Disclosed:
- Nov 3, 2025
CVE-2025-11758 on NVD →
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out
medium
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authe...
- CVSS:
- 4.3
- Affected:
- up to 2.0
- Fixed in:
- 2.0.1
- Disclosed:
- Oct 21, 2025
CVE-2025-6833 on NVD →
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting
medium
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at...
- CVSS:
- 6.1
- Affected:
- up to 2.0
- Fixed in:
- 2.0.1
- Disclosed:
- Aug 1, 2025
CVE-2025-6832 on NVD →
All in One Time Clock Lite <= 1.3.325 - Cross-Site Request Forgery
medium
The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.325. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perfor...
- CVSS:
- 4.3
- Affected:
- up to 1.3.325
- Fixed in:
- 1.3.326
- Disclosed:
- Apr 24, 2025
CVE-2025-46513 on NVD →
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier [aio-time-clock-lite] < 1.3.326
unknown
[en] Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite allows Cross Site Request Forgery. This issue affects All in One Time Clock Lite: from n/a through 1.3.324.
- Affected:
- up to 1.3.326
- Fixed in:
- 1.3.326
- Disclosed:
- Apr 24, 2025
CVE-2025-46513 on NVD →
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier [aio-time-clock-lite] < 1.3.321
unknown
[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions.
- Affected:
- up to 1.3.321
- Fixed in:
- 1.3.321
- Disclosed:
- Apr 23, 2023
CVE-2022-44594 on NVD →
All in One Time Clok Lite <= 1.3.320 - Authenticated (Admin+) Stored Cross-Site Scripting
medium
The All in One Time Clok Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in versions up to, and including, 1.3.320 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in page...
- CVSS:
- 5.5
- Affected:
- up to 1.3.320
- Fixed in:
- 1.3.321
- Disclosed:
- Nov 30, 2022
CVE-2022-44594 on NVD →
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier [aio-time-clock-lite] < 2.0.1
unknown
- Affected:
- up to 2.0.1
- Fixed in:
- 2.0.1
CVE-2025-6832 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database