CVE-2025-6832

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6832", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-27T18:17:51.215Z", "datePublished": "2025-08-02T08:24:47.167Z", "dateUpdated": "2026-04-08T17:04:21.783Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:21.783Z"}, "affected": [{"vendor": "codebangers", "product": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-08-01T19:33:30.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T13:43:04.869974Z", "id": "CVE-2025-6832", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T13:43:11.470Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-04T13:43:04.869974Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T13:43:08.357Z"}}], "cna": {"title": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "codebangers", "product": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-01T19:33:30.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:21.783Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6832", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:04:21.783Z", "dateReserved": "2025-06-27T18:17:51.215Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-02T08:24:47.167Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier", "vendor": "codebangers", "versions": [{"lessThanOrEqual": "2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier para WordPress es vulnerable a ataques de Cross-Site Scripting reflejado a trav\u00e9s del par\u00e1metro 'nonce' en todas las versiones hasta la 2.0 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-6832", "lastModified": "2026-06-17T10:02:39.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6832", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-04T13:43:04.869974Z", "version": "2.0.3"}}]}, "published": "2025-08-02T09:15:26.757", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:28:24.802445+00:00", "value": {"mitigation_remediation": ["Upgrade the All in One Time Clock Lite plugin to the latest available version (greater than 2.0) to eliminate the reflected XSS vulnerability.", "If upgrading is not immediately possible, configure a web application firewall to block or sanitize the 'nonce' parameter so that non\u2011numeric or script payloads are rejected.", "As a temporary measure, disable the All in One Time Clock Lite plugin until a patched version is released by the vendor."], "summary": {"action": "Patch Immediately", "impact": "Reflected Cross\u2011Site Scripting via the 'nonce' parameter"}, "threat_synthesis": {"affected_systems": "All versions of the All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier plugin, distributed by codebangers, up to and including 2.0 are affected. The plugin is distributed for WordPress sites and may be installed on any WordPress installation that uses these plugin versions.", "description_and_impact": "The All in One Time Clock Lite plugin for WordPress contains a reflected cross\u2011site scripting flaw that is triggered through the 'nonce' parameter. An attacker can insert malicious scripts that are reflected in the response when a specially crafted URL is accessed. Because the parameters are not properly sanitized or escaped, the injected code can run in the browsers of any user who follows the link, potentially exposing sensitive data, hijacking sessions, or injecting further malicious content.", "risk_and_exploitability": "The vulnerability receives a CVSS score of 6.1, indicating moderate severity. The EPSS score is below 1\u202f%, reflecting a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers would need to craft a URL with a malicious nonce value and convince an unauthenticated user to click it. If successful, the reflected script runs in the victim\u2019s browser, leading to potential data theft, session hijacking, or defacement. The risk is moderate but still warrants timely remediation."}}}}, "created": "2025-08-05T11:39:02.070311+00:00", "updated": "2026-04-21T19:30:06.093913+00:00", "vendors": ["codebangers", "codebangers$PRODUCT$all_in_one_time_clock_lite", "wordpress", "wordpress$PRODUCT$wordpress"]}