The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/743c4d79-e1d5-4fb0-a17d-296df2c54e8a/ | Exploit Third Party Advisory |
Configurations
History
11 Jun 2025, 19:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dev4press:coreactivity:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-79 | |
| First Time |
Dev4press coreactivity
Dev4press |
|
| References | () https://wpscan.com/vulnerability/743c4d79-e1d5-4fb0-a17d-296df2c54e8a/ - Exploit, Third Party Advisory |
15 May 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-15 20:15
Updated : 2025-06-11 19:47
NVD link : CVE-2024-0852
Mitre link : CVE-2024-0852
JSON object : View
Products Affected
dev4press
- coreactivity
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')