445 matches found
CVE-2025-60503
CVE-2025-60503 — Cross-Site Scripting XSS Almacenado en UltimatePOS UltimateFosters v4.8 Fecha de publicación: 2025-10-30 ID de CVE: CVE-2025-60503 RESERVADO Investigador: Vivien Lebas Proveedor: UltimateFosters Producto: UltimatePOS Versión afectada: 4.8 Tipo de vulnerabilidad: Cross-Site...
CVE-2025-0924-different
Altre vulnerabilità emerse durante l'analisi di CVE-2025-0924 01. Panoramica di Stored XSS, WordPress e WP Activity Log 1 Panoramica di Stored XSS, WordPress e WP Activity Log Lo Stored XSS è una vulnerabilità in cui uno script malevolo viene salvato sul server e, successivamente, viene eseguito...
CVE-2026-78333
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...
CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...
EUVD-2026-66885
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...
CVE-2026-78333
The 12 Step Meeting List WordPress plugin (versions 3.17 through 3.19.16 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. An unauthenticated user can inject a malicious payload via the Geocode Event Log , which is stored unsanitised in the plugin's activity log and later rendered in ...
LogDash Activity Log <= 1.1.3 - SQL Injection
The LogDash Activity Log plugin for WordPress is vulnerable to SQL Injection via the username parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2023-4279
CVE ID : CVE-2023-4279 漏洞类型 : IP 地址欺骗 描述 : 该插件从可能不可信的请求头中获取客户端 IP 地址，攻击者可以操纵该值，从而隐藏恶意流量的来源。 复现步骤 : root@kitploit: 1. 在用户活动日志 设置中，启用“记录用户的 IP 地址”选项并保存设置。 2. 在浏览器中运行以下代码，并注意后端显示的 IP 地址已被伪造。 await fetch"/wp-login.php", "headers": "content-type": "application/x-www-form-urlencoded", "Client-Ip":...
CVE-2026-54806
WP Activity Log Iniezione di Oggetti PHP CVE-2026-54806 PoC 📜 Descrizione CVE-2026-54806 è una vulnerabilità critica CVSS 9.8 di iniezione di oggetti PHP non autenticata nel plugin WP Activity Log per WordPress wp-security-audit-log di Melapress. Un utente malintenzionato non autenticato può...
CVE-2023-4281
ID CVE : CVE-2023-4281 Type de vulnérabilité : Usurpation d'adresse IP Description : Le plugin Activity Log récupère les adresses IP des clients à partir d'en-têtes potentiellement non fiables, permettant à un attaquant de manipuler leur valeur. Cela peut être utilisé pour masquer la source du...
CVE-2023-51214
Vorgeschlagene Beschreibung Cross-Site-Scripting-Schwachstelle in der Implementierung eines Aktivitätsprotokolls in Ihrer Web-App mit PHP v.1 ermöglicht es einem entfernten Angreifer, beliebigen Code über eine manipulierte Nutzlast an die URL auszuführen. Schwachstellentyp Cross-Site-Scripting XS...
CVE-2024-10793
CVE-2024-10793 CVE-2024-10793 poc exploit Lo script CVE-2024-10793.yaml è necessario per cercare un plugin. Lo script CVE-2024-10793.sh è l'exploit stesso. Per la post-esplorazione, puoi usare beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log Il plugin WP Activity Log per...
CVE-2026-19052
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...
CVE-2026-19052 ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...
CVE-2026-17541
The CVE-2026-17541 affects the WordPress File Manager plugin prior to version 6.9.1. A REST API route lacks authorization checks, enabling unauthenticated users to read the file activity log and reveal file operations, involved paths, and the performing user. Documents confirm the vulnerability a...
EUVD-2026-55040
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
CVE-2026-65512 WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...