CVE-2024-0868

The coreActivity: Activity Logging plugin for WordPress (versions prior to 2.1 ) is vulnerable to an unauthenticated IP spoofing flaw. The plugin incorrectly retrieves and logs request IP addresses from headers such as X-FORWARDED , allowing an attacker to provide an arbitrary value to spoof thei...

CVE-2024-0852

The coreActivity: Activity Logging plugin for WordPress (versions prior to 1.8.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly escape certain request data when it is outputted back in the admin dashboard. This flaw allows unauthenticated ...