Activity Log
by WordPress
Source repositories
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-27858 | Hig | 0.48 | 7.4 | 0.01 | Nov 8, 2022 | CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. | ||
| CVE-2024-10788 | Hig | 0.40 | 7.2 | 0.01 | Nov 21, 2024 | The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2023-4281 | Med | 0.35 | 5.3 | 0.01 | Sep 25, 2023 | This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. | ||
| CVE-2018-8729 | Med | 0.03 | 6.1 | 0.05 | Mar 15, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped. |
- risk 0.48cvss 7.4epss 0.01
CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.
- risk 0.40cvss 7.2epss 0.01
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.35cvss 5.3epss 0.01
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
- risk 0.03cvss 6.1epss 0.05
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.