CVE-2023-4281

CVE ID: CVE-2023-4281 Vulnerability Type: IP Address Spoofing Description: The Activity Log plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce:...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

CVE-2023-51214

Suggested description Cross Site Scripting vulnerability in Implementing an Activity Log in Your Web App Using PHP v.1 allows a remote attacker to execute arbitrary code via a crafted payload to the URL. Vulnerability Type Cross Site Scripting XSS Vendor of Product sourcecodester.com Affected...

LogDash Activity Log <= 1.1.3 - SQL Injection

The LogDash Activity Log plugin for WordPress is vulnerable to SQL Injection via the username parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-0924-different

Other Vulnerabilities Discovered During CVE-2025-0924 Analysis 01. Overview of Stored XSS and WordPress, WP Activity Log 1 Overview of Stored XSS and WordPress, WP Activity Log Stored XSS is a type of vulnerability where a malicious script is stored on the server and later automatically executed...

CVE-2023-4279

CVE ID : CVE-2023-4279 Vulnerability Type : IP Address Spoofing Description : This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce : root@kitploit: 1...

CVE-2025-60503

CVE-2025-60503 — Stored Cross-Site Scripting XSS in UltimatePOS UltimateFosters v4.8 Publication date: 2025-10-30 CVE ID: CVE-2025-60503 RESERVED Researcher: Vivien Lebas Vendor: UltimateFosters Product: UltimatePOS Affected version: 4.8 Vulnerability type: Stored Cross-Site Scripting XSS Severit...

CVE-2026-84759

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

EUVD-2026-69935

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-84759 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-84759

CVE-2026-84759 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Activity Log plugin by ArYo, affecting versions ≤ 2.13.1 . The flaw was discovered by Asim Alshaya and is rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicati...

WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Activity Log versions = 2.13.1...

PT-2026-84697

Name of the Vulnerable Software and Affected Versions Activity Log versions prior to 2.13.2 Description An unauthenticated Cross Site Request Forgery CSRF issue exists. CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to do on a web application...

CVE-2026-78333

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

EUVD-2026-66885

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

CVE-2026-78333

The 12 Step Meeting List WordPress plugin (versions 3.17 through 3.19.16 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. An unauthenticated user can inject a malicious payload via the Geocode Event Log , which is stored unsanitised in the plugin's activity log and later rendered in ...

CVE-2026-19052

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

CVE-2026-19052 ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...