CVE-2024-10788

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10788
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10788.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10788
Published
2024-11-21T11:15:22.363Z
Modified
2026-04-10T05:08:38.701716Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.

References

Affected packages

Git / github.com/pojome/activity-log

Affected ranges

Type
GIT
Repo
https://github.com/pojome/activity-log
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f75ee2a477ca459a5054014904bca7c97f4ea93e
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.11.2"
        }
    ]
}

Affected versions

2.*
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.11.0
2.11.1
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.4.0
2.4.1
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
2.8.0
2.8.1
2.8.4
2.8.5
2.8.6
2.8.8
2.8.9
2.9.0
2.9.1
2.9.2
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10788.json"