{"error":0,"message":null,"data":{"name":"WP Activity Log","plugin":"wp-security-audit-log","link":"https:\/\/wordpress.org\/plugins\/wp-security-audit-log\/","latest":"1787651340","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"a4025632cf069aad49cf6c8a7c8c757455d656a09b2dbe55e641c9ad323b97da","name":"WP Activity Log [wp-security-audit-log] < 1.2.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2014-5072","name":"CVE-2014-5072","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2014-5072","description":"[en] Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.","date":"2018-04-06"},{"id":"fbcd9f914ccea2dda0b2cb28b896e9c1e2115a76","name":"WP Activity Log <= 1.2.4 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-124-cross-site-request-forgery","description":"Cross-site request forgery (CSRF) vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.","date":"2014-08-01"}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}]}},{"uuid":"47fe8759d6a877d5bbbc852dc5ffcc8225b9f92e9ccfebb4864649df2c7dc1ea","name":"WP Activity Log [wp-security-audit-log] < 3.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2018-8719","name":"CVE-2018-8719","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2018-8719","description":"[en] An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content\/uploads\/wp-security-audit-log\/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information.","date":"2018-04-04"},{"id":"92d957b4128d13be75d997ac3b4059189d96fd4a","name":"WordPress WP Security Audit Log plugin <=3.1.1 - Sensitive Information Disclosure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-security-audit-log-plugin-3-1-1-sensitive-information-disclosure","description":"Sensitive Information Disclosure found in WordPress WP Security Audit Log plugin (versions <=3.1.1). Failed login log files indexable by Google.","date":"2018-04-05"},{"id":"bdf180ebf2d53a34d066d7fc4deaa1b23a7b3c43","name":"WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-security-audit-log-plugin-311-sensitive-information-disclosure","description":"An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content\/uploads\/wp-security-audit-log\/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information.","date":"2018-03-28"},{"id":"2711a857-f4aa-4590-8593-3e6e53cebf05","name":"WP Security Audit Log Plugin &lt;= 3.1.1 - Sensitive Information Disclosure","link":"https:\/\/wpscan.com\/vulnerability\/2711a857-f4aa-4590-8593-3e6e53cebf05","description":"No protection on the wp-content\/uploads\/wp-security-audit-log\/*\r\nwhich is indexed by google and allows for attackers to possibly find user information (bad login attempts)","date":null}],"impact":{"cvss":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.0","vector":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-532","name":"Insertion of Sensitive Information into Log File","description":"The product writes sensitive information to a log file."}]}},{"uuid":"570a1b76466bbd479c19f6a556e4589f19988182293174ec6fdce3bda902fac9","name":"WP Activity Log [wp-security-audit-log] < 4.4.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"f53f1894e144f41b1cd5bcd4f0aad0770337d1ff","name":"WordPress WP Activity Log plugin < 4.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-440-toggle-the-debug-mode-via-cross-site-request-forgery-csrf-vulnerability","description":"Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress WP Activity Log plugin (versions < 4.4.0).","date":"2022-02-28"}],"impact":[]},{"uuid":"1c70b871790f0848866cf2571333edd2d5176012862302fa56087732e49fbd2c","name":"WP Activity Log [wp-security-audit-log] < 4.4.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"9e47a3832653b15f0cb8b31e5cb3a7bbce2d775c","name":"WordPress WP Activity Log plugin < 4.4.0 - Sensitive Information Disclosure vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-440-sensitive-information-disclosure-vulnerability","description":"Sensitive Information Disclosure vulnerability discovered in WordPress WP Activity Log plugin (versions < 4.4.0).","date":"2022-02-28"}],"impact":[]},{"uuid":"18b633ba321dd87aba388073f1e7c15c58ded7e0137ef374119d8d4239f43bf3","name":"WP Activity Log [wp-security-audit-log] < 4.1.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b206c85207184c90b5da8fadceb9e030e85ab1b6","name":"WordPress WP Activity Log plugin <= 4.1.4 - SQL Injection (SQLi) in External Database Module vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-4-1-4-sql-injection-sqli-in-external-database-module-vulnerability","description":"SQL Injection (SQLi) in External Database Module vulnerability found by WP deeply in WordPress WP Activity Log plugin (versions <= 4.1.4 ).","date":"2020-11-14"}],"impact":[]},{"uuid":"9621a92d8bd46db2e9b8e13d460f291d411d8fdf2eedd4be3a3e3f9e75a3098a","name":"WP Activity Log [wp-security-audit-log] < 4.0.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.0.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"24301bb430992c87d3e0d632fc40dc519c6ea787","name":"WordPress WP Security Audit Log plugin <= 4.0.1 - Broken Access Control vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log1\/vulnerability\/wordpress-wp-security-audit-log-plugin-4-0-1-broken-access-control-vulnerability","description":"Broken Access Control vulnerability discovered by NinTechNet in WordPress WP Security Audit Log plugin (versions <= 4.0.1).","date":"2020-03-08"}],"impact":[]},{"uuid":"cede1d81ea9f7af4c7af376cb2275ded09356d6e7509964302f6069e056170ba","name":"WP Activity Log [wp-security-audit-log] < 3.3.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b7bae5d02d2da5afeaae72c8ac7f132274650ed9","name":"WordPress WP Security Audit Log <=3.3.1.1 - Authenticated Option Update vulnerability (Fremius Library security issue)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-security-audit-log-3-3-1-1-authenticated-option-update-vulnerability-fremius-library-security-issue","description":"Authenticated Option Update vulnerability (Fremius Library security issue) found in WordPress WP Security Audit Log (versions <=3.3.1.1).","date":"2019-03-02"}],"impact":[]},{"uuid":"d7cf107218d325cd4e53c4ad741168775891b866a29078e1c9f20b81af2d61ac","name":"WP Activity Log [wp-security-audit-log] < 2.4.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"423db6f18e40bada4f753f75004f47b51c4f8620","name":"WordPress WP Security Audit Log plugin <= 2.4.3 - Reflected Cross-Site Scripting (XSS) Vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-security-audit-log-plugin-2-4-3-reflected-cross-site-scripting-xss-vulnerability","description":"Reflected Cross-Site Scripting (XSS) Vulnerability exists in AjaxDisableCustomField() function, in the file \/wp-security-audit-log.php. The \"notice\" variable is printed on the front-end without escaping it.\nUpdate the plugin.","date":"2017-06-27"}],"impact":[]},{"uuid":"19ef9879c1b0d078398c2911489bf3c0d7aaec2efdc26de092a9dcee92ac0b40","name":"WP Activity Log [wp-security-audit-log] < 2.4.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.4.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"8d7110c59eeaeea16f7bff36361b3b20f8e5e06d","name":"WordPress Security Audit Log Plugin <= 2.4.3 - Cross Site Scripting","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/security-audit-log\/vulnerability\/wordpress-security-audit-log-plugin-2-4-3-cross-site-scripting","description":"This plugin is prone to a cross site scripting vulnerability in the \"\/wp-security-audit-log.php\" file. Because of this vulnerability, the attackers can inject arbitrary web script or HTML.\nUpdate the plugin.","date":"2016-06-27"}],"impact":[]},{"uuid":"bb64c677df9a6b10ba3d014dedcdca3f235d911e99d433c9db78b39cf31528e6","name":"WP Activity Log [wp-security-audit-log] < 4.4.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6dae6dca-7474-4008-9fe5-4c62b9f12d0a","name":"Unauthorised AJAX Calls via Freemius","link":"https:\/\/wpscan.com\/vulnerability\/6dae6dca-7474-4008-9fe5-4c62b9f12d0a","description":"The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and\/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in admin toggle the debug mode via a CSRF attack.","date":null}],"impact":[]},{"uuid":"85630bbd45777af51c97d5bf8946abb5b145e6b2adfd57c27a4e179c66a0ba5a","name":"WP Activity Log [wp-security-audit-log] < 3.3.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6ff37c2e-e21d-4abc-bafe-8ca6a2c1ed76","name":"Freemius Library &lt; 2.2.4 - Subscriber+ Arbitrary Option Update","link":"https:\/\/wpscan.com\/vulnerability\/6ff37c2e-e21d-4abc-bafe-8ca6a2c1ed76","description":"The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options","date":null}],"impact":[]},{"uuid":"b5f53b97bacefa35a03e124e18626ed368c5c6e880ccfd186256210d61a29a96","name":"WP Activity Log [wp-security-audit-log] < 4.4.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6d8910c719b2a132ec93828cd37e418b19cac960","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-sdk-242-missing-authorization-checks","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2022-03-04"},{"id":"CVE-2022-4974","name":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-4974","description":"The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2024-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"6.3","severity":"m","exploitable":"2.8","impact":"3.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","score":"6.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"3.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"b469880f057f1db9b319c3e9793b356b7b24d5cf29bfb4ddb30c0b672ef57455","name":"WP Activity Log [wp-security-audit-log] < 4.1.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"811a04839242bd189bf9b866f09bc65da4e8e353","name":"WP Activity Log <= 4.1.4 - SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-414-sql-injection","description":"The WP Activity Log plugin for WordPress is vulnerable to SQL Injection via multiple parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2020-11-04"}],"impact":[]},{"uuid":"223fc4bec449fcd78d6d19eca3e01846420d0850e909abd94e7bdc36ea7489ca","name":"WP Activity Log [wp-security-audit-log] < 3.3.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.3.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7e57cd4f4859826de00a8e2b09ee24fb7f2d824b","name":"Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/freemius-sdk-223-missing-authorization-to-arbitrary-options-update","description":"The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially take over the site.","date":"2019-02-25"}],"impact":[]},{"uuid":"eb5e082de4fcc9700ef717a211555b53ecf7526e1d28d364c632ff254dd67c86","name":"WP Activity Log [wp-security-audit-log] >= 1.5 - <= 2.4.3","description":null,"operator":{"min_version":"1.5","min_operator":"ge","max_version":"2.4.3","max_operator":"le","unfixed":"0","closed":"0"},"source":[{"id":"07ea4892a30a27b952c46754c12677a5b88cefb2","name":"WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-15-243-reflected-cross-site-scripting","description":"The WP Activity Log plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018notice\u2019 parameter in versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2016-06-27"}],"impact":[]},{"uuid":"119b023230129ddbdae9c661c6b2703eae9d02c1442b779c72d3544dd2035209","name":"WP Activity Log [wp-security-audit-log] < 4.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2020-36716","name":"CVE-2020-36716","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2020-36716","description":"[en] The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.","date":"2023-06-07"},{"id":"a86adca0-dda7-4880-8019-02927d0b147a","name":"WP Security Audit Log &lt; 4.0.2 - Broken Access Control in First-Time Install Wizard","link":"https:\/\/wpscan.com\/vulnerability\/a86adca0-dda7-4880-8019-02927d0b147a","description":"Broken access control vulnerability affecting version 4.0.1 and below that could lead to privilege escalation, sensitive data exposure and insecure deserialisation.\r\nTo exploit the vulnerability, the wizard must not have been completed, otherwise it won&rsquo;t work","date":null},{"id":"f7f5606afbdc5801a9e93afbe3a286c95a617d9b","name":"WP Activity Log <= 4.0.1 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-401-missing-capabilities-check","description":"The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.","date":"2020-03-08"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"7.3","severity":"h","exploitable":"3.9","impact":"3.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L","score":"7.3","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"low","a":"low","exploitable":"3.9","impact":"3.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"614f3f8018b3b46f2c6a658f3f4213e3da46c534a497c06044278a92dcc8e862","name":"WP Activity Log [wp-security-audit-log] < 4.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-2286","name":"CVE-2023-2286","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-2286","description":"[en] The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2023-06-09"},{"id":"f085ef498aa0ff481149ad1fa48066272de66bc0","name":"WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/wp-activity-log-450-cross-site-request-forgery-via-ajax-run-cleanup","description":"The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2023-05-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"fa37cd4ef162ed21b87c3a31e894373db4ea739e9387c035aba12544c1430853","name":"WP Activity Log [wp-security-audit-log] < 4.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-2285","name":"CVE-2023-2285","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-2285","description":"[en] The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_switch_db function. This makes it possible for unauthenticated attackers to make changes to the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2023-06-09"},{"id":"5bfb97a6b5ffce7be09989f1cbbb870ad2523a6f","name":"WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log-premium\/wp-activity-log-premium-450-cross-site-request-forgery-via-ajax-switch-db","description":"The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_switch_db function. This makes it possible for unauthenticated attackers to make changes to the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2023-05-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"e85ffa0a3090c6dd77c029ce8b50c2ce6e346349799a55f36d7be6e9a03afd5a","name":"WP Activity Log [wp-security-audit-log] < 4.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-2284","name":"CVE-2023-2284","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-2284","description":"[en] The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings.","date":"2023-06-09"},{"id":"302e4f0cbe5c0ccce5458218dae954d16d249263","name":"WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log-premium\/wp-activity-log-premium-450-missing-authorization-via-ajax-switch-db","description":"The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_db function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers with subscriber-level or higher to make changes to the plugin's settings.","date":"2023-05-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"7dc0f73e6b992a52bf428b72a4a891483723ece7024f2ff7e76e4390102ee9a7","name":"WP Activity Log [wp-security-audit-log] < 4.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-2261","name":"CVE-2023-2261","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-2261","description":"[en] The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of users with accounts on the site. This includes ids, usernames and emails.","date":"2023-06-09"},{"id":"edbc908fc0ac95e451d20a94ad811482bab112b3","name":"WordPress  WP Activity Log Plugin  < 4.5.2 is vulnerable to Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-4-5-2-subscriber-information-leak-vulnerability","description":"Update the WordPress WP Activity Log plugin to the latest available version (at least 4.5.2).\nMarco Wotschka discovered and reported this Sensitive Data Exposure vulnerability in WordPress WP Activity Log Plugin.  This vulnerability has been fixed in version 4.5.2.","date":"2023-06-22"},{"id":"4c710610257b8da74b1896f2074a06c810a62ba4","name":"WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/wp-activity-log-450-missing-capabilities-check-to-user-enumeration","description":"The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call function in versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with subscriber-level access or higher, to obtain a list of users with accounts on the site. This includes ids, usernames and emails.","date":"2023-05-17"},{"id":"3c5e45fd-933f-47e0-bfb5-b376fab6b88b","name":"WP Activity Log &lt; 4.5.2 - Subscriber+ Information Leak","link":"https:\/\/wpscan.com\/vulnerability\/3c5e45fd-933f-47e0-bfb5-b376fab6b88b","description":"The plugin does not properly implement a capability check on the handle_ajax_call function, leading to an authorization bypass that allows authenticated users to obtain a list of users&#039; information, including ids, usernames, and emails.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"f761f25a9b2bd73e73e020b7eab2519562b33554d0125365d208c1fbf2b3a4e3","name":"WP Activity Log [wp-security-audit-log] < 4.4.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-33999","name":"CVE-2023-33999","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-33999","description":"[en] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.\n\nThis issue affects WP Mail Log: from n\/a through 1.0.2.","date":"2026-06-11"},{"id":"75a5111e6e25b3c9ff06054d7ec37db0095cde35","name":"WordPress  WP Activity Log Plugin  <= 4.4.2.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-4-4-2-1-reflected-cross-site-scripting-xss-vulnerability","description":"Update the WordPress WP Activity Log plugin to the latest available version.\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Activity Log Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 4.4.3.","date":"2023-07-19"},{"id":"58ab5352-d783-431a-b0a5-382381cc13fd","name":"Freemius SDK &lt; 2.5.10 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/58ab5352-d783-431a-b0a5-382381cc13fd","description":"The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK.","date":"2023-07-18"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"90433be40fa9e72522de044f8c7fb5f10b541b52767ebcd21e463bc335ab6eed","name":"WP Activity Log [wp-security-audit-log] < 4.0.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.0.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"da8225bf69bb6d6edfa71c5601415a515ed073f1","name":"WordPress  WP Activity Log Plugin  <= 4.0.1 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-4-0-1-broken-access-control-vulnerability","description":"Update the WordPress WP Activity Log plugin to the latest available version (at least 4.0.2).\nJerome Bruandet (NinTechNet) discovered and reported this Broken Access Control vulnerability in WordPress WP Activity Log Plugin.  This vulnerability has been fixed in version 4.0.2.","date":"2023-03-08"}],"impact":[]},{"uuid":"64068ecc7a45b7bbf6d74c10d97cf6be403f54526800d24c10d249114e6d3638","name":"WP Activity Log [wp-security-audit-log] < 4.1.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"4ec13b3c-7fc9-4d9a-98f5-e59187d128a4","name":"WP Activity Log &lt; 4.1.5 - SQL Injection in External Database Module","link":"https:\/\/wpscan.com\/vulnerability\/4ec13b3c-7fc9-4d9a-98f5-e59187d128a4","description":"Two SQL Injection vulnerabilities were identified in the WP Activity Log WordPress plugin.\r\n\r\nThe changelog of the plugin states:\r\n\r\n&quot;SQL Injection in external database module reported by WP deeply. Thank you for the responsible disclosure.&quot;","date":null}],"impact":[]},{"uuid":"10d60446c3c0acb6cd5187032f6fce5128367daf2d73e192afc24bf91d6a38c2","name":"WP Activity Log [wp-security-audit-log] >= 1.5 - <= 2.4.3","description":null,"operator":{"min_version":"1.5","min_operator":"ge","max_version":"2.4.3","max_operator":"le","unfixed":"0","closed":"0"},"source":[{"id":"91e568d3-ba3d-4941-bb58-4f6630d2cded","name":"WP Security Audit Log 1.5-2.4.3 - Authenticated Reflected Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/91e568d3-ba3d-4941-bb58-4f6630d2cded","description":"The WP Activity Log WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting (XSS)  security vulnerability.","date":null}],"impact":[]},{"uuid":"755c12b990263d54239d95b794d381ff9984bbc1aeea545b871258eaa462279c","name":"WP Activity Log [wp-security-audit-log] < 4.6.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.6.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-50905","name":"CVE-2023-50905","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-50905","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n\/a through 4.6.1.","date":"2024-02-29"},{"id":"c947781590a7fd1845c1cd8f57c88e6358dd9d9b","name":"WordPress  WP Activity Log Plugin  <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-plugin-4-6-1-cross-site-scripting-xss-vulnerability","description":"Update the WordPress WP Activity Log plugin to the latest available version (at least 4.6.2).\nNamGyu Kang discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Activity Log Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 4.6.2.\nThis vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"0e50903b939681cda7e3aeaa1b6af81dbd61f94e","name":"WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-461-unauthenticated-stored-cross-site-scripting","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-02-14"},{"id":"4fdb7553-3c9c-4c77-a78d-a83627787d29","name":"WP Activity Log &lt; 4.6.2 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/4fdb7553-3c9c-4c77-a78d-a83627787d29","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"eef41f58c07f019cf8f74d1f336fa0537e563a7e53aa02ec1c1fc82120e1c3f0","name":"WP Activity Log [wp-security-audit-log] < 5.2.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-10793","name":"CVE-2024-10793","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-10793","description":"[en] The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.","date":"2024-11-15"},{"id":"633c9470f223d01af7ae87054781b1be3ddc911a","name":"WordPress WP Activity Log Plugin <= 5.2.1 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-plugin-5-2-1-unauthenticated-stored-cross-site-scripting-vulnerability","description":"<p>WordPress WP Activity Log Plugin <= 5.2.1 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: WP Activity Log<\/p><p>Link: https:\/\/wordpress.org\/plugins\/wp-security-audit-log\/#developers<\/p><p>Affected Version <= 5.2.1<\/p><p>Fixed in version 5.2.2 <\/p>","date":"2024-11-14"},{"id":"cc05bd87fcd81ea6624246ba3f8740d6592deb09","name":"WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-521-unauthenticated-stored-cross-site-scripting-via-user-id-parameter","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.","date":"2024-11-14"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"7.2","severity":"h","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"7.2","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"d4da1668f2612ef0974ea7aad81850571c5956adc3a731443db73b9033636946","name":"WP Activity Log [wp-security-audit-log] < 5.3.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.3.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-0924","name":"WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-0924","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018message\u2019 parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"0000-00-00"},{"id":"de812399ab6288e25740bea3d351a9569b105970","name":"WordPress WP Activity Log Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log\/vulnerability\/wordpress-wp-activity-log-5-2-2-unauthenticated-stored-cross-site-scripting-xss-vulnerability","description":"<p>WordPress WP Activity Log Plugin <= 5.2.2 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: WP Activity Log<\/p><p>Fixed in version 5.3.0 <\/p><p>Affected Version <= 5.2.2<\/p><p>CVE: CVE-2025-0924<\/p>","date":"2025-02-16"},{"id":"e2b0fe81255a910590ec553b975d646ee1835fbe","name":"WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-522-unauthenticated-stored-cross-site-scripting","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018message\u2019 parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-02-12"},{"id":"EUVD-2025-1928","name":"EUVD-2025-1928","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-1928","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018message\u2019 parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-02-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.100"}},{"uuid":"c56ea46e141dffaff594a21bde3e276931e5ffe9dae5f387fa0db235dab0d900","name":"WP Activity Log [wp-security-audit-log] < 5.3.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.3.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-0767","name":"WP Activity Log 5.3.2 - Insecure deserialization","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-0767","description":"WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp\/classes\/Writers\/class-csv-writer.php.","date":"0000-00-00"},{"id":"1f4edb3b00dad0446ff3640adf8a5ffb92637d49","name":"WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-532-authenticated-admin-php-object-injection","description":"The WP Activity Log plugin for WordPress is vulnerable to PHP Object Injection in version 5.3.2 via deserialization of untrusted input from the 'query' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.","date":"2025-02-27"},{"id":"EUVD-2025-5996","name":"EUVD-2025-5996","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-5996","description":"WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp\/classes\/Writers\/class-csv-writer.php.","date":"2025-02-27"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"3.9","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"3.9","impact":"5.9"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"cvss4":{"version":"4.0","vector":"CVSS:4.0\/AV:N\/AC:H\/AT:N\/PR:N\/UI:N\/VC:N\/VI:L\/VA:L\/SC:N\/SI:N\/SA:N","score":"6.3","severity":"medium","av":"network","ac":"high","at":"none","pr":"none","ui":"none","vc":"none","vi":"low","va":"low","sc":"none","si":"none","sa":"none"},"epss":"0.001"}},{"uuid":"a41822bdd8249ab1daf819557d2ddd6478ed86f45e3a2fc11bb0ef1e38f8b639","name":"WP Activity Log [wp-security-audit-log] < 5.6.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.6.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-25331","name":"CVE-2026-25331","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-25331","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n\/a through <= 5.5.4.","date":"2026-02-19"},{"id":"b601cc024f68dc3c105f7c216cbe47fc2ac4ff1d","name":"Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/activity-log-554-authenticated-contributor-stored-cross-site-scripting","description":"The Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-02-14"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"6.5","severity":"m","exploitable":"2.3","impact":"3.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.3","impact":"3.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"88f7257e7e6a5175d3ed15f11ebf822c3fb63553fe4c0a8e5b7574f8865d4203","name":"WP Activity Log [wp-security-audit-log] < 5.6.3.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.6.3.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-45435","name":"CVE-2026-45435","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-45435","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.\n\nThis issue affects WP Activity Log: from n\/a through 5.6.3.","date":"2026-05-25"},{"id":"EUVD-2026-31764","name":"EUVD-2026-31764","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-31764","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.\n\nThis issue affects WP Activity Log: from n\/a through 5.6.3.","date":"2026-05-25"},{"id":"252ac51e401caaf941a9e8e56d5a10c3db85bf6d","name":"WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-563-authenticated-subscriber-stored-cross-site-scripting","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-05-19"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"6.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"53ed9a85e53ce728adef6a8e30910cd5ecb19c016c30c56e20f56718101143ae","name":"WP Activity Log [wp-security-audit-log] < 5.6.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.6.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-54806","name":"CVE-2026-54806","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-54806","description":"[en] Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.","date":"2026-06-17"},{"id":"EUVD-2026-37642","name":"EUVD-2026-37642","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2026-37642","description":"Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.","date":"2026-06-17"},{"id":"636c5a155584427d6397b69d73304604c18c5378","name":"WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-5631-unauthenticated-php-object-injection","description":"The WP Activity Log plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 5.6.3.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","date":"2026-06-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}]}},{"uuid":"e74a54b01f422d20ca62af04c95847316dbae9d70fd9e6709f44f2914ad245d2","name":"WP Activity Log [wp-security-audit-log] < 5.6.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.6.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-56005","name":"CVE-2026-56005","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-56005","description":"[en] Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions.","date":"2026-06-25"},{"id":"40b8698ea5257a411133540c3eddf761e640e875","name":"WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-5631-authenticated-subscriber-stored-cross-site-scripting","description":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-06-19"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"389aeb43ca6fe9ae068dcdd5ba9ab065e6b636242c26708565295fbce105442a","name":"WP Activity Log [wp-security-audit-log] < 5.6.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.6.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-65512","name":"CVE-2026-65512","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-65512","description":"[en] Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery.\n\nThis issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.","date":"2026-07-23"},{"id":"368a57a671820fefb7254ad05ab82143fbfbbabf","name":"WP Activity Log <= 5.6.4 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/e0d1b675-7b9a-49ff-a308-075fefca9743","description":"The WP Activity Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.6.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2026-07-23"},{"id":"79a7b5ee2d40fd9cc07109a4ee71672a3135e8ee","name":"WP Activity Log <= 5.6.4 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-security-audit-log\/wp-activity-log-564-cross-site-request-forgery","description":"The WP Activity Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.6.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2026-06-19"},{"id":"256ac663ff83314485ca2e90771d6aeb8d5f1f26","name":"WordPress WP Activity Log Premium Plugin <= 5.6.4 is vulnerable to Cross Site Request Forgery (CSRF)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-security-audit-log-premium\/vulnerability\/wordpress-wp-activity-log-premium-plugin-5-6-4-cross-site-request-forgery-csrf-vulnerability","description":"<p>WordPress WP Activity Log Premium Plugin <= 5.6.4 is vulnerable to Cross Site Request Forgery (CSRF)<\/p><p>Software: WP Activity Log Premium<\/p><p>Fixed in version 5.6.5 <\/p><p>Affected Version <= 5.6.4<\/p><p>CVE: CVE-2026-65512<\/p>","date":"2026-08-05"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1785997410"}