520 matches found
WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting
Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://pojo.me Software Link: https://wordpress.org/plugins/aryo-activity-log/ Version: 2.4.0 CVE :...
WordPress Activity Log plugin <=2.4.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities
Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress Activity Log plugin versions =2.4.0 Solution Update the WordPress Activity Log plugin to the latest available version at least 2.4.1...
WordPress Activity Log Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers set up a personal blog site. activity Log plugin is used in one of the log plugin. A cross-site scripting vulnerability exists in WordPress...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
CVE-2018-8729 describes multiple Stored XSS flaws in the WordPress Activity Log plugin (aryo-activity-log) prior to 2.4.1. The vulnerability stems from unescaped post/title data stored in logs (e.g., get_the_title calls), allowing remote attackers to inject JavaScript/HTML. Public exploit routes ...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
PT-2018-18603 · WordPress · Wp Activity Log
Name of the Vulnerable Software and Affected Versions: Activity Log plugin versions prior to 2.4.1 for WordPress Description: The issue allows remote attackers to inject arbitrary JavaScript or HTML via a title that is not properly escaped, potentially leading to cross-site scripting XSS attacks...
Activity Log <= 2.4.0 - Multiple Cross-Site Scripting (XSS)
The Activity Log WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
WordPress User Activity Log Plugin <= 1.2.3 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) Vulnerabilities
There's no escaping done for $fromemail and $toemail variables. Also, there's missing a nonce check. Solution Update the plugin...
WordPress Activity Log Plugin <= 2.2.12 - Authenticated Information Disclosure Vulnerability
WordPress Activity Log Plugin Authenticated Information Disclosure Vulnerability is due to the AJAX accessible function ajaxaalgetproperties, in the file /classes/class-aal-settings.php, not having a check to make sure that the request is coming from a user and he should be able to access to it...
Weblate: Information Disclosure on demo.weblate.org
Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...
WordPress WassUp Real Time Analytics Plugin <= 1.9 - Persistent XSS
Because of this vulnerability attackers can inject malicious JavaScript code into the application, which will execute within the browser of any user who views the Activity Log, in general WP admin. Solution Update the plugin...
WordPress Activity Log 2.3.2 Cross Site Scripting
------------------------------------------------------------------------ Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin ------------------------------------------------------------------------ Edwin Molenaar, July 2016...
WordPress Activity Log Plugin <= 2.3.2 - Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability in "page" parameter. It allows attackers to inject arbitrary JavaScript or HTML code. Solution Update the plugin...