Aryo Activity Log Vulnerabilities

[en] The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

Affected:

up to 2.11.2

Fixed in:

2.11.2

Disclosed:

Nov 21, 2024

CVE-2024-10788 on NVD →

The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVSS:

7.2

Affected:

up to 2.11.1

Fixed in:

2.11.2

Disclosed:

Nov 20, 2024

CVE-2024-10788 on NVD →

[en] This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.

Affected:

up to 2.8.8

Fixed in:

2.8.8

Disclosed:

Sep 25, 2023

CVE-2023-4281 on NVD →

The Activity Log plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.8.7. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging. Unauthenticated attackers can supply the X-Forwarded-For header with with a different I...

CVSS:

5.3

Affected:

up to 2.8.7

Fixed in:

2.8.8

Disclosed:

Sep 1, 2023

CVE-2023-4281 on NVD →

[en] CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.

Affected:

up to 2.8.4

Fixed in:

2.8.4

Disclosed:

Nov 8, 2022

CVE-2022-27858 on NVD →

The Activity Log plugins for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.8.3. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configu...

CVSS:

8.3

Affected:

up to 2.8.3

Fixed in:

2.8.4

Disclosed:

Sep 26, 2022

CVE-2022-27858 on NVD →

The Activity Log plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions 2.3.5 - 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQ...

CVSS:

8.8

Affected:

2.3.5 – 2.6.1

Fixed in:

2.7.0

Disclosed:

May 3, 2021

The Activity Log plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions 2.3.5 - 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQ...

Affected:

2.3.5 – 2.6.1

Fixed in:

2.6.1

Disclosed:

May 3, 2021

Authenticated SQL Injection (SQLi) vulnerability discovered by Synacktiv in WordPress Activity Log plugin (versions <= 2.6.1).

Affected:

up to 2.7.0

Fixed in:

2.7.0

Disclosed:

May 3, 2021

[en] The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Aug 21, 2019

CVE-2016-10891 on NVD →

[en] The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Aug 21, 2019

CVE-2016-10890 on NVD →

[en] Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

Affected:

up to 2.4.1

Fixed in:

2.4.1

Disclosed:

Mar 15, 2018

CVE-2018-8729 on NVD →

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

CVSS:

6.1

Affected:

up to 2.4.0

Fixed in:

2.4.1

Disclosed:

Mar 8, 2018

CVE-2018-8729 on NVD →

WordPress Activity Log Plugin Authenticated Information Disclosure Vulnerability is due to the AJAX accessible function ajax_aal_get_properties(), in the file /classes/class-aal-settings.php, not having a check to make sure that the request is coming from a user and he should be able to access to it (normally that wou...

Affected:

up to 2.3.0

Fixed in:

2.3.0

Disclosed:

Jul 5, 2017

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS in the search_data parameter in the aryo-activity-log/classes/class-aal-activity-log-list-table.php file.

CVSS:

6.1

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Aug 3, 2016

CVE-2016-10891 on NVD →

The Activity Log plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th...

CVSS:

6.1

Affected:

up to 2.3.2

Fixed in:

2.3.3

Disclosed:

Aug 3, 2016

CVE-2016-10890 on NVD →

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Aug 3, 2016

This plugin is prone to a cross site scripting vulnerability in "page" parameter. It allows attackers to inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Aug 3, 2016

The Activity Log Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Jul 29, 2016

The Activity Log Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

Affected:

up to 2.3.3

Fixed in:

2.3.3

Disclosed:

Jul 29, 2016

Because of this vulnerability, an attacker can inject malicious JavaScript code in to the application. Upgrade the WordPress plugin to the newer stable and safe version.

Affected:

up to 2.3.2

Fixed in:

2.3.2

Disclosed:

Jul 11, 2016

This plugin is prone to a full path disclosure vulnerability. Update the plugin.

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Aug 1, 2014

The Activity Log plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.0.3 via direct calls to the ~/class-aal-integration-woocommerce.php file. This can allow unauthenticated attackers to extract sensitive data including the full path of the WordPress installation.

CVSS:

7.5

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Feb 27, 2014

The Activity Log plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.0.3 via direct calls to the ~/class-aal-integration-woocommerce.php file. This can allow unauthenticated attackers to extract sensitive data including the full path of the WordPress installation.

Affected:

up to 2.0.4

Fixed in:

2.0.4

Disclosed:

Feb 27, 2014

The plugin was vulnerable to SQL Injection in the order column of the past events table.

Affected:

up to 2.7.0

Fixed in:

2.7.0

The Activity Log WordPress plugin was affected by a Cross-Site Scripting (XSS) in &#039;page&#039; security vulnerability.

Affected:

up to 2.3.3

Fixed in:

2.3.3

The Activity Log WordPress plugin was affected by a Full Path Disclosure security vulnerability.

Affected:

up to 2.1.4

Fixed in:

2.1.4