Timeline Awesome Vulnerabilities

The History Timeline plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62150 on NVD →

[en] Missing Authorization vulnerability in Themesawesome History Timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects History Timeline: from n/a through 1.0.6.

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62150 on NVD →

[en] Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.

Affected:

up to 1.0.6

Fix:

No patched version reported

Disclosed:

Sep 23, 2022

CVE-2022-37328 on NVD →

The History Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 1.0.5

Fix:

No patched version reported

Disclosed:

Sep 2, 2022

CVE-2022-37328 on NVD →