CVE-2026-57674

9th percentile — higher than 9% of all known CVEs

The Timetics plugin version 1.0.58 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.

The risk involves potential execution of arbitrary JavaScript in users' browsers, which can lead to session theft, redirection to malicious sites, or theft of sensitive data.

Immediately update the Timetics plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.