Stored Cross-Site Scripting Vulnerability in Activity Log Plugin
CVE-2024-10788
7.2HIGH
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 21 November 2024
What is CVE-2024-10788?
The Activity Log – Monitor & Record User Changes plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue stemming from inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 2.11.1. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages, which will execute when an administrative user accesses an affected page. The lack of proper validation allows malicious code to be transmitted through event parameters, posing significant risks to website security and integrity.
Affected Version(s)
Activity Log – Monitor & Record User Changes * <= 2.11.1