Skip to content
OpenAdvisories

Vendor

Codebangers

5 known vulnerabilities.

Products

All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier 3 All in One Time Clock Lite 2
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-11758

    All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure

    The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via…

    Codebangers All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Web / CMS
  • Medium 4.3
    CVE-2025-6833

    All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out

    The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validati…

    Codebangers All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Web / CMS
  • Medium 6.1
    CVE-2025-6832

    All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting

    The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and o…

    Codebangers All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Web / CMS
  • Medium 4.3
    CVE-2025-46513

    WordPress All in One Time Clock Lite plugin < 1.3.326 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affects All in One Time Clock Lite: from n/a through < 1.3.326.

    Codebangers All in One Time Clock Lite
  • Medium 4.8
    CVE-2022-44594

    WordPress All in One Time Clock Lite Plugin <= 1.3.320 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions.

    Codebangers All in One Time Clock Lite