History Log By Click5 Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in click5 History Log by click5 allows Stored XSS. This issue affects History Log by click5: from n/a through 1.0.13.

Affected:

up to 1.0.13

Fix:

No patched version reported

Disclosed:

Jun 9, 2025

CVE-2025-47598 on NVD →

The History Log by click5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 1.0.13

Fix:

No patched version reported

Disclosed:

May 30, 2025

CVE-2025-47598 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in click5 History Log by click5 allows SQL Injection. This issue affects History Log by click5: from n/a through 1.0.13.

Affected:

up to 1.0.13

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31531 on NVD →

The History Log by click5 plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL...

CVSS:

7.5

Affected:

up to 1.0.13

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31531 on NVD →

[en] The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.

Affected:

up to 1.0.13

Fixed in:

1.0.13

Disclosed:

Nov 6, 2023

CVE-2023-5082 on NVD →

The History Log by click5 plugin for WordPress is vulnerable to time-based SQL Injection via the mail log functionality in all versions up to, and including, 1.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authe...

CVSS:

6.6

Affected:

up to 1.0.12

Fixed in:

1.0.13

Disclosed:

Oct 15, 2023

CVE-2023-5082 on NVD →