Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
76 results · page 1 of 2
Oct 14, 2026GamiPress: Does not properly authorize access to private activity log entriesCVE-2026-107320 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
- Product
- GamiPress
- Fixed in
- 8.0.6
- What to do
- Update GamiPress to 8.0.6 or newer.
Sep 30, 2026Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.CVE-2026-62085 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
- Affected
- up to 5.6.6
- What to do
- Affects up to 5.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not check ownership before changing the privacy level of an activity and its attached mediaCVE-2026-88912 · WordPress plugins & themes · reported by WPScanMedium 4.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Fixed in
- 4.7.12
- What to do
- Update rtMedia for WordPress, BuddyPress and bbPress to 4.7.12 or newer.
Sep 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.CVE-2026-84759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 202612 Step Meeting List: Does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area pageCVE-2026-78333 · WordPress plugins & themes · reported by WPScanHigh 8.8
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
- Product
- 12 Step Meeting List
- Fixed in
- 3.19.17
- What to do
- Update 12 Step Meeting List to 3.19.17 or newer.
Aug 26, 2026Project Manager: Does not check that the user whose activity is being requested is the one making the request in one of its REST API routesCVE-2026-74930 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
- Product
- Project Manager
- Fixed in
- 4.0.7
- What to do
- Update Project Manager to 4.0.7 or newer.
Jul 23, 2026Melapress WP Activity Log and Melapress WP Activity Log Premium: Cross-Site request forgery (CSRF)CVE-2026-65512 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4.
- Product
- Melapress WP Activity Log and Melapress WP Activity Log Premium
- Affected
- up to 5.6.4
- What to do
- Affects up to 5.6.4. Update Melapress WP Activity Log and Melapress WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 25, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56005 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
- Product
- WP Activity Log
- Affected
- up to 5.6.3.1
- What to do
- Affects up to 5.6.3.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.CVE-2026-54806 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
- Affected
- up to 5.6.3.1
- What to do
- Affects up to 5.6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2026the activity mention resolver that, when username compatibility mode is enabled,: BuddyPress 14.4.0 contains a regular expression injectionCVE-2026-53674 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
- Product
- the activity mention resolver that, when username compatibility mode is enabled,
- What to do
- Update the activity mention resolver that, when username compatibility mode is enabled, to the newest version.
Full record and what to do →NVD recordbuddypress.orgwordpress.org
Jun 1, 2026Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: Insertion of Sensitive Information Into Sent DataCVE-2026-42673 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: from n/a through 3.3.6.
- Product
- Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-45435 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3.
- Product
- WP Activity Log
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 13, 2026coreActivity: Activity Logging for: PHP Object InjectionCVE-2026-7635 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is due to the plugin failing to validate or strip PHP serialization syntax from the User-Agent HTTP header before storing it in the logmeta table, and subsequently calling `maybe_unserialize()` on every retrieved `meta_value` in `query_metas()` without verifying the data was originally serialized by the application. This makes it possible for unauthenticated attackers to inject a crafted PHP serialized payload via the User-Agent header during any logged event (such as a failed login attempt), which, when an administrator views the Logs page, is deserialized and passed to `DeviceDetector::setUserAgent()`, triggering a Fatal TypeError that creates a persistent Denial of Service condition blocking administrator access to the Logs page entirely.
- Product
- coreActivity: Activity Logging for
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update coreActivity: Activity Logging for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
May 9, 2026Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity: Authentication Bypass to Information DisclosureCVE-2026-8198 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an Authorization header skip Bearer token validation and fall through to an unconditional return true statement, bypassing all authentication checks. This makes it possible for unauthenticated attackers to access the /wp-json/logtivity/v1/options REST API endpoint and retrieve all plugin configuration options, including the logtivity_site_api_key which can be used to impersonate the site in API calls to the Logtivity service.
- Product
- Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026ActivityPub: Does not properly filter posts to be displayedCVE-2026-4338 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
- Product
- ActivityPub
- Fixed in
- 8.0.2
- What to do
- Update ActivityPub to 8.0.2 or newer.
Mar 21, 2026Tour & Activity Operator Plugin for TourCMS: Stored Cross-Site ScriptingCVE-2026-1806 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms_doc_link shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Tour & Activity Operator Plugin for TourCMS
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Tour & Activity Operator Plugin for TourCMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25331 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.
- Product
- WP Activity Log
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2026Activity Log for: Unauthorized access of dataCVE-2026-1671 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_action() function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view potentially sensitive information (e.g., the password of a higher level user, such as an administrator) contained in the exposed log files.
- Product
- Activity Log for
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Activity Log for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 28, 2026User Activity Log: Does not properly handle failed login attempts in some casesCVE-2025-13471 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026User Activity Log: A limited options updateCVE-2025-11877 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 31, 2025BuddyPress Activity Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62760 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortcode allows Stored XSS.This issue affects BuddyPress Activity Shortcode: from n/a through <= 1.1.8.
- Product
- BuddyPress Activity Shortcode
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update BuddyPress Activity Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Activity Plus Reloaded for BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
- Product
- Activity Plus Reloaded for BuddyPress
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Activity Plus Reloaded for BuddyPress: Missing AuthorizationCVE-2025-30957 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
- Product
- Activity Plus Reloaded for BuddyPress
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
- Fixed in
- 4.1.4
- What to do
- Update the plugin to 4.1.4 or newer.
May 15, 2025coreActivity: Activity Logging for: Does not escape some request dataCVE-2024-0852 · WordPress plugins & themes · reported by WPScanHigh 8.8
The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
- Product
- coreActivity: Activity Logging for
- Fixed in
- 1.8.1
- What to do
- Update coreActivity: Activity Logging for to 1.8.1 or newer.
May 15, 2025LogDash Activity Log: Hooks the wp_login_failed function (from src/Hooks/UsersCVE-2023-6030 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker
- Product
- LogDash Activity Log
- Fixed in
- 1.1.4
- What to do
- Update LogDash Activity Log to 1.1.4 or newer.
May 7, 2025Wbcom Designs - Activity Link Preview For BuddyPress: Server-Side Request Forgery (SSRF)CVE-2025-47548 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress activity-link-preview-for-buddypress allows Server Side Request Forgery.This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through <= 1.4.4.
- Product
- Wbcom Designs - Activity Link Preview For BuddyPress
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Wbcom Designs - Activity Link Preview For BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Login Manager – Design Login Page, View Login Activity, Limit Login Attempts: Stored Cross-Site ScriptingCVE-2025-2613 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Login Manager – Design Login Page, View Login Activity, Limit Login Attempts
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Login Manager – Design Login Page, View Login Activity, Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2025Activity Reactions For Buddypress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31006 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Activity Reactions For Buddypress activity-reactions-for-buddypress allows Reflected XSS.This issue affects Activity Reactions For Buddypress: from n/a through <= 1.0.22.
- Product
- Activity Reactions For Buddypress
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Activity Reactions For Buddypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025coreActivity: Activity Logging for: SQL InjectionCVE-2025-3436 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- coreActivity: Activity Logging for
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update coreActivity: Activity Logging for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2025WordPress Activity O Meter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13668 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- WordPress Activity O Meter
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress Activity O Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2025WP Activity Log 5.3.2 was found to be vulnerable.CVE-2025-0767 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 6.3
WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.
- Affected
- 5.3.2 to 5.3.2
- What to do
- Affects 5.3.2 to 5.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordco.wordpress.orgfluidattacks.com
Feb 17, 2025WP Activity Log: Stored Cross-Site ScriptingCVE-2025-0924 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Activity Log
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2025Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5.CVE-2025-24982 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
- What to do
- Update the plugin to the newest version.
Jan 24, 2025Activity Plus Reloaded for BuddyPress: Blind Server-Side Request ForgeryCVE-2024-11913 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Activity Plus Reloaded for BuddyPress
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2024Activity Log – Monitor & Record User Changes: Stored Cross-Site ScriptingCVE-2024-10788 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
- Product
- Activity Log – Monitor & Record User Changes
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Activity Log – Monitor & Record User Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2024WP Activity Log: Stored Cross-Site ScriptingCVE-2024-10793 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
- Product
- WP Activity Log
- Affected
- up to 5.2.1
- What to do
- Affects up to 5.2.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 1, 2024User Activity Log Pro: Missing AuthorizationCVE-2024-37929 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4.
- Product
- User Activity Log Pro
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update User Activity Log Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024GHActivity: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha.
- Product
- GHActivity
- Affected
- up to 2.0.0-alpha
- What to do
- Affects up to 2.0.0-alpha. Update GHActivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2024ActivityPub: Missing AuthorizationCVE-2023-52199 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Matthias Pfefferle & Automattic ActivityPub.This issue affects ActivityPub: from n/a through 1.0.5.
- Product
- ActivityPub
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update ActivityPub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2024coreActivity: Activity Logging plugin for: Retrieved IP addresses of requests via headers such X-FORWARDED to log themCVE-2024-0868 · WordPress plugins & themes · reported by WPScanMedium 5.3
The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
- Product
- coreActivity: Activity Logging plugin for
- Fixed in
- 2.1
- What to do
- Update coreActivity: Activity Logging plugin for to 2.1 or newer.
Apr 15, 2024User Activity Log Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32137 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin User Activity Log Pro.This issue affects User Activity Log Pro: from n/a through 2.3.4.
- Product
- User Activity Log Pro
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update User Activity Log Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024User Activity Log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31356 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
- Product
- User Activity Log
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024WP Activity Log Premium: SQL InjectionCVE-2024-2018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. One demonstrated attack included the injection of a PHP Object.
- Product
- WP Activity Log Premium
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmelapress.comwordfence.com
Feb 29, 2024WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50905 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1.
- Product
- WP Activity Log
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions.CVE-2023-28694 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions.
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Simple History – user activity log, audit tool: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45350 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through 3.3.1.
- Product
- Simple History – user activity log, audit tool
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Simple History – user activity log, audit tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023User Activity Log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-37966 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2.
- Product
- User Activity Log
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023User Activity Log Pro: Does not properly escape recorded User-Agents in the user activity logs dashboardCVE-2023-5167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.
- Product
- User Activity Log Pro
- Fixed in
- 2.3.4
- What to do
- Update User Activity Log Pro to 2.3.4 or newer.
Oct 16, 2023This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate itCVE-2023-5133 · WordPress plugins & themes · reported by WPScanHigh 7.5
This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.