CVE-2025-0924

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-0924

creationtimestamp| type| source ---|---|--- 2025-02-17 04:30:31+00:00| seen| https://infosec.exchange/users/cve/statuses/114017345944337141 2025-02-17 05:15:54+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lidyj5vflp2t 2025-02-17 06:30:33+00:00| seen|...

CVE-2025-0924 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-0924

CVE-2025-0924 (WP Activity Log) : Stored XSS via the message parameter in all WordPress WP Activity Log versions up to 5.2.2. Exploitation does not require authentication. Root cause: insufficient input sanitization and output escaping. Impact: injected scripts run when users view the page. A fix...