Skip to content

Product

Dev4Press coreactivity vulnerabilities

2 published CVES affecting Dev4Press coreactivity, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest Dev4Press coreactivity CVEs

Newest publication first

  1. CVE-2024-0852 coreActivity < 1.8.1 - Unauthenticated Stored XSS

    Published
    HighCVSS 8.8 EPSS 0.71%

    The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin

  2. CVE-2024-0868 coreActivity < 2.1 - Unauthenticated IP Spoofing

    Published
    MediumCVSS 5.3 EPSS 0.48%

    The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.