Vulnerabilities

TI-2024-10000 CVE-2024-10788 · GHSA-8fph-vpfj-qv4c

Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context

LOW 33

The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitizat…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00788 Published 2024-11-21 No fix listed CWE-79

TI-2023-25500 CVE-2023-47177 · GHSA-24m4-9q2q-2374

WordPress Linker Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yakir Sitbon, Ariel Klikstein Linker plugin <= 1.2.1 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00361 Published 2023-11-06 No fix listed CWE-79

TI-2016-08928 CVE-2016-10890 · GHSA-pf2f-cg54-74x6

The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.

LOW 29

The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01111 Published 2019-08-21 No fix listed CWE-79

TI-2016-08929 CVE-2016-10891 · GHSA-q8wf-899q-7mj8

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.

LOW 29

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01034 Published 2019-08-21 No fix listed CWE-79

TI-2018-06302 CVE-2018-8729 · GHSA-vrh3-cv34-wh8g

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before…

MEDIUM 60

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0533 Published 2018-03-15 No fix listed CWE-79

Vulnerabilities

Filters

Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context

WordPress Linker Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before…