CVE-2018-8729 Activity Log <= 2.4.0 - Multiple Cross-Site Scripting
MediumCVSS 6.1
EPSS 5.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress aryo-activity-log(WordPress) | < 2.4.1 | 2.4.1 |
| pojo activity log | < 2.4.1 | 2.4.1 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- github.com patch third-party-advisory
- github.com patch release-notes third-party-advisory
- plugins.trac.wordpress.org patch third-party-advisory
- wordpress.org release-notes third-party-advisory
- 44437 exploit third-party-advisory vdb-entry