medium6.1Public exploit code
CVE-2018-8729
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Activity Log 2.4.0 - Stored Cross-Site Scripting2018-04-10 · webapps · php
- WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting2018-04-05 · webapps · php
Impact
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pojo | Activity Log | before 2.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fb
- https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9
- https://plugins.trac.wordpress.org/changeset/1836276
- https://wordpress.org/plugins/aryo-activity-log/#developers
- https://www.exploit-db.com/exploits/44437/
- https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fb
- https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9
- https://plugins.trac.wordpress.org/changeset/1836276
- https://wordpress.org/plugins/aryo-activity-log/#developers
- https://www.exploit-db.com/exploits/44437/