High severity7.2NVD Advisory· Published Nov 21, 2024· Updated Jun 17, 2026
CVE-2024-10788
CVE-2024-10788
Description
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <=2.11.1
- elemntor/Activity Log – Monitor & Record User Changesv5Range: 0
Patches
Vulnerability mechanics
References
3- www.wordfence.com/threat-intel/vulnerabilities/id/75324bf1-a00e-4da7-8d42-d224c39ceb79nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/aryo-activity-log/tags/2.11.0/hooks/class-aal-hook-themes.phpnvdProduct
- plugins.trac.wordpress.org/browser/aryo-activity-log/tags/2.11.0/hooks/class-aal-hook-themes.phpnvdProduct
News mentions
0No linked articles in our index yet.