The All in One Time Clock Lite WordPress plugin suffers from a reflected XSS vulnerability (CWE-79) via the 'nonce' parameter in versions up to 2.0. This occurs because the plugin does not properly sanitize or escape input before including it in web pages, allowing attackers to inject malicious scripts. Exploitation requires user interaction (clicking a malicious link) and can lead to script execution in the victim's browser, potentially impacting confidentiality and integrity of user data within the affected site context. The vulnerability is unauthenticated and remotely exploitable over the network.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected website for users who click a crafted link. This can lead to theft of sensitive information, session hijacking, or other client-side impacts. The CVSS vector indicates low attack complexity, no privileges required, but user interaction is necessary. The impact affects confidentiality and integrity but not availability.

No official patch or fix is currently available or referenced. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution with links involving the affected plugin and consider disabling or removing the plugin if feasible. Monitoring vendor channels for updates is recommended.