CVE-2025-24718
Published: 31 January 2025
Summary
CVE-2025-24718 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-24718 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WP Sessions Time Monitoring Full Automatic plugin (activitytime) for WordPress websites. The issue affects all versions of the plugin from n/a through 1.1.1 inclusive.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no privileges required, user interaction needed, and changed scope with low impacts on confidentiality, integrity, and availability. An unauthenticated attacker can exploit it by crafting a malicious input that reflects unsanitized on a vulnerable site, tricking a user (such as an administrator) into interacting with it via a phishing link or similar vector, thereby executing arbitrary JavaScript in the victim's browser session.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/activitytime/vulnerability/wordpress-wp-sessions-time-monitoring-full-automatic-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this Reflected XSS vulnerability in WP Sessions Time Monitoring Full Automatic plugin version 1.1.1. Security practitioners should consult the advisory for recommended mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3910
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin enables exploitation of the web app via crafted URLs; description explicitly notes delivery through phishing links to execute arbitrary JS in victim browser.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information Output Filtering directly prevents reflected XSS by sanitizing output before rendering in web pages, addressing the improper neutralization during web page generation.
Information Input Validation neutralizes malicious inputs before processing, mitigating the root cause of reflected XSS in the WordPress plugin.
Flaw Remediation ensures timely patching of the specific XSS vulnerability in the WP Sessions Time Monitoring plugin versions up to 1.1.1.