Stored Cross-Site Scripting Vulnerability in Activity Log Plugin

CVE-2024-10788

Summary

The Activity Log – Monitor & Record User Changes plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue stemming from inadequate input sanitization and output escaping. This vulnerability affects all versions up to and including 2.11.1. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages, which will execute when an administrative user accesses an affected page. The lack of proper validation allows malicious code to be transmitted through event parameters, posing significant risks to website security and integrity.

References