CVE-2018-8729

CVE-2018-8729 describes multiple Stored XSS flaws in the WordPress Activity Log plugin (aryo-activity-log) prior to 2.4.1. The vulnerability stems from unescaped post/title data stored in logs (e.g., get_the_title calls), allowing remote attackers to inject JavaScript/HTML. Public exploit routes ...

CVE-2018-8729

Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...

CVE-2018-8729

Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...

PT-2018-18603 · WordPress · Wp Activity Log

Name of the Vulnerable Software and Affected Versions: Activity Log plugin versions prior to 2.4.1 for WordPress Description: The issue allows remote attackers to inject arbitrary JavaScript or HTML via a title that is not properly escaped, potentially leading to cross-site scripting XSS attacks...

Activity Log <= 2.4.0 - Multiple Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

WordPress User Activity Log Plugin <= 1.2.3 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) Vulnerabilities

There's no escaping done for $fromemail and $toemail variables. Also, there's missing a nonce check. Solution Update the plugin...

WordPress Activity Log Plugin <= 2.2.12 - Authenticated Information Disclosure Vulnerability

WordPress Activity Log Plugin Authenticated Information Disclosure Vulnerability is due to the AJAX accessible function ajaxaalgetproperties, in the file /classes/class-aal-settings.php, not having a check to make sure that the request is coming from a user and he should be able to access to it...

Weblate: Information Disclosure on demo.weblate.org

Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...

WordPress WassUp Real Time Analytics Plugin <= 1.9 - Persistent XSS

Because of this vulnerability attackers can inject malicious JavaScript code into the application, which will execute within the browser of any user who views the Activity Log, in general WP admin. Solution Update the plugin...

WordPress Activity Log 2.3.2 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin ------------------------------------------------------------------------ Edwin Molenaar, July 2016...

WordPress Activity Log Plugin <= 2.3.2 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in "page" parameter. It allows attackers to inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Activity Log Plugin <= 2.3.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Activity Log <= 2.3.2 - Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress Plugin Activity Log 2.3.1 - Persistent Cross-Site Scripting

WordPress Plugin Activity Log 2.3.1 - Persistent Cross-Site Scripting Persistent Cross-Site Scripting in WordPress Activity Log plugin Han Sahin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WordPress Activity Log plugin. By using this vulnerability an attacker ca...

WordPress Plugin Activity Log 2.3.1 - Persistent Cross-Site Scripting

Persistent Cross-Site Scripting in WordPress Activity Log plugin Han Sahin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WordPress Activity Log plugin. By using this vulnerability an attacker can inject malicious JavaScript code into the application, which will...

Activity Log <= 2.3.1 - Stored Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

WordPress Activity Log 2.3.1 Persistent Cross Site Scripting

Persistent Cross-Site Scripting in WordPress Activity Log plugin Han Sahin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WordPress Activity Log plugin. By using this vulnerability an attacker can inject malicious JavaScript code into the application, which will...

WordPress Activity Log Plugin 2.3.1 - Persistent XSS

Because of this vulnerability, an attacker can inject malicious JavaScript code in to the application. Solution Upgrade the WordPress plugin to the newer stable and safe version...

WordPress Activity Log 2.3.1 Plugin - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Persistent Cross-Site Scripting in WordPress Activity Log plugin Han Sahin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WordPress Activity Log plugin. By using this vulnerability an attacker can inject malicio...

WP Security Audit Log 1.5-2.4.3 - Authenticated Reflected Cross-Site Scripting (XSS)

The WP Activity Log WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...