CVE-2024-10788

The WordPress plugin Activity Log – Monitor & Record User Changes (up to version 2.11.1) is affected by a Stored Cross-Site Scripting (XSS) flaw in the event context due to insufficient input sanitization and output escaping. Unauthenticated attackers could inject arbitrary scripts that run when ...

CVE-2024-10788 Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context

The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

PT-2024-16547 · WordPress · The Activity Log – Monitor & Record User Changes

Name of the Vulnerable Software and Affected Versions: The Activity Log – Monitor & Record User Changes plugin for WordPress versions up to, and including, 2.11.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing...

WordPress plugin Activity Log – Monitor & Record User Changes 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WordPress Activity Log – Monitor & Record User Changes plugin <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context vulnerability

Unauthenticated Stored Cross-Site Scripting via Event Context vulnerability discovered by mikemyers in WordPress Plugin Activity Log versions = 2.11.1...

WordPress Activity Log Plugin <= 2.11.1 is vulnerable to Cross Site Scripting (XSS)

Software Activity Log Type Plugin Vulnerable versions = 2.11.1 Fixed in 2.11.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10788 Patch priority Medium CVSS severity Medium 7.1 Developer Elementor PSID 657fbb862f42 Credits mikemyers Required...

CVE-2024-10793

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

WordPress plugin WP Activity Log 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress WP Activity Log plugin <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by mikemyers in WordPress Plugin WP Activity Log versions = 5.2.1...

WordPress WP Activity Log Plugin <= 5.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Activity Log Type Plugin Vulnerable versions = 5.2.1 Fixed in 5.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10793 Patch priority Medium CVSS severity Medium 7.1 Developer Melapress PSID ad9533377437 Credits mikemyers Required...

CVE-2024-37929 WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability

Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4...

CVE-2024-37929

CVE-2024-37929 is a Missing Authorization vulnerability in the Solwin User Activity Log Pro WordPress plugin, affecting versions up to and including 2.3.4. Public sources describe an incorrect access control configuration enabling unauthorized access to certain functionality. The CVE record lists...

CVE-2024-37929 WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability

Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4...

PT-2024-27834 · Unknown · Solwin User Activity Log Pro

Name of the Vulnerable Software and Affected Versions: solwin User Activity Log Pro versions through 2.3.4 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions throu...

WordPress plugin User Activity Log Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-32034

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admi...

CVE-2024-32034

Summary: CVE-2024-32034 is a cross-site scripting (XSS) vulnerability in the Decidim admin activity log when an admin assigns a valuator to a proposal or performs an action that creates an admin log with an XSS payload. Affected versions: Decidim before 0.27.7 and before 0.28.2 (with fixes in 0.2...

CVE-2024-32034 Cross-site scripting (XSS) in the decidim admin activity log

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admi...

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

Impact The admin panel is subject to potential XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. Patches N/A Workarounds Redirect the pages /admin and /admin/logs to other admi...

GHSA-RX9F-5GGV-5RH6 Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

Impact The admin panel is subject to potential XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. Patches N/A Workarounds Redirect the pages /admin and /admin/logs to other admi...