User Activity Log
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:user_activity_log:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | User Activity Log (13cb77a4-5bdf-5352-94c3-d03109fbc930) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-13471 |
vulnerable | 2026-06-08 07:04:32.288138 |
User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
Published: 2026-01-28T06:00:03.740Z
Updated: 2026-04-02T12:39:54.086Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4279 |
vulnerable | 2026-06-08 06:16:11.977074 |
User Activity Log < 1.6.7 - IP Spoofing
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Published: 2023-09-04T11:27:04.063Z
Updated: 2025-04-23T16:17:42.783Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4269 |
vulnerable | 2026-06-08 06:16:11.949751 |
User Activity Log < 1.6.6 - Subscriber+ Log Export
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Published: 2023-09-04T11:26:56.095Z
Updated: 2025-04-23T16:18:24.845Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3435 |
vulnerable | 2026-06-08 06:09:39.543291 |
User Activity Log < 1.6.5 - Unauthenticated SQLi
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
Published: 2023-08-14T19:10:19.283Z
Updated: 2024-10-09T13:21:07.606Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2761 |
vulnerable | 2026-06-08 06:02:42.963672 |
User Activity Log < 1.6.3 - Admin+ SQL Injection
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Published: 2023-07-24T10:20:26.121Z
Updated: 2024-10-24T15:03:30.446Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.