GCVE - cpe:2.3:a:pojo:activity_log:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:pojo:activity_log:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Pojo (`918eebf9-88de-5a5c-b635-0977f72512e3`)
Product	Activity Log (`02221f38-8f6c-5498-94db-703417febfff`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-10788`	vulnerable	2026-06-08 06:23:47.551607	Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context HIGH (7.2) The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page. Published: 2024-11-21T05:33:50.411Z Updated: 2026-04-08T17:01:17.997Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/75324bf1-a00e-4da7-8d42-d224c39ceb79?source=cve https://plugins.trac.wordpress.org/browser/aryo-activity-log/tags/2.11.0/hooks/class-aal-hook-themes.php#L21 https://plugins.trac.wordpress.org/browser/aryo-activity-log/tags/2.11.0/hooks/class-aal-hook-themes.php#L18	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-8729`	vulnerable	2026-06-08 05:12:06.367872	Details available Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped. Published: 2018-03-15T17:00:00.000Z Updated: 2024-11-14T20:48:12.262Z Open on db.gcve.eu Reference links https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fb https://plugins.trac.wordpress.org/changeset/1836276 https://www.exploit-db.com/exploits/44437/ https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9 https://wordpress.org/plugins/aryo-activity-log/#developers	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10891`	vulnerable	2026-06-08 05:07:25.788589	Details available The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. Published: 2019-08-21T18:20:54.000Z Updated: 2024-08-06T03:38:56.670Z Open on db.gcve.eu Reference links https://wordpress.org/plugins/aryo-activity-log/#developers	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10890`	vulnerable	2026-06-08 05:07:25.788219	Details available The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. Published: 2019-08-21T18:21:36.000Z Updated: 2024-08-06T03:38:56.615Z Open on db.gcve.eu Reference links https://wordpress.org/plugins/aryo-activity-log/#developers	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.