CVE-2024-10793

🗓️ 15 Nov 2024 05:30:56Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 79 Views🌐 WEB

WP Activity Log plugin CVE-2024-10793 Unauthenticated Stored XS

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for Cross-site Scripting in Melapress Wp_Activity_Log	19 Dec 202415:50	–	githubexploit
Circl	CVE-2024-10793	15 Nov 202405:32	–	circl
CNNVD	WordPress plugin WP Activity Log 跨站脚本漏洞	15 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-10793 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter	15 Nov 202405:30	–	cvelist
NVD	CVE-2024-10793	15 Nov 202406:15	–	nvd
Patchstack	WordPress WP Activity Log plugin <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability	14 Nov 202421:35	–	patchstack
Patchstack	WordPress WP Activity Log Plugin <= 5.2.1 is vulnerable to Cross Site Scripting (XSS)	14 Nov 202400:00	–	patchstack
RedhatCVE	CVE-2024-10793	5 Feb 202504:57	–	redhatcve
Vulnrichment	CVE-2024-10793 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter	15 Nov 202405:30	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 11, 2024 to November 17, 2024)	21 Nov 202415:38	–	wordfence

NVD

Vulners

Vulnrichment

Node

melapress wp_activity_logRange<5.2.2wordpress

[
  {
    "vendor": "melapress",
    "product": "WP Activity Log",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/44f3b2e4-c537-4369-b2d6-39fbc6cb8e08
plugins	www.plugins.trac.wordpress.org/browser/wp-security-audit-log/tags/5.2.1/classes/WPSensors/class-wp-system-sensor.php

Parameter	Position	Path	Description	CWE
cmd	query param	wp-content/plugins/sogrid/shell.php	Stored Cross-Site Scripting via the user_id parameter in WP Activity Log plugin (CWE-79) as described in CVE-2024-10793; PoC demonstrates shell access via the vulnerable endpoint.	CWE-79

08 Apr 2026 16:49Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.1 - 7.2

EPSS0.68714

SSVC

CWE-79