plugin
28 known security issues reported for the User Activity Log WordPress plugin. Most recent disclosed Jan 28, 2026.
Running User Activity Log on your site? Check whether your installed version is affected.
Scan your site free[en] The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
[en] The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push s...
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select...
The User Activity Log plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to update option values to one on the WordPress site. This...
[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
The User Activity Log plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access a...
[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through 1.6.2.
[en] The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
[en] This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
The User Activity Log plugin for WordPress is vulnerable to IP Address Spoofing in versions up to and including 1.6.6. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging. Attackers can supplied the X-Forwarded-For header with with a different IP Address t...
[en] The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
Update the WordPress User Activity Log plugin to the latest available version (at least 1.6.6). WordFence discovered and reported this Broken Access Control vulnerability in WordPress User Activity Log Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a func...
The User Activity Log plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.6.4 via the ual_export_log() function that is missing a capability check. This can allow unauthenticated attackers to extract sensitive data including user roles, usernames, and IP Addresses. T...
The User Activity Log plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.6.4 via the ual_export_log() function that is missing a capability check. This can allow unauthenticated attackers to extract sensitive data including user roles, usernames, and IP Addresses. T...
The User Activity Log plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.6.4 via the ual_export_log() and ual_export_user_log() function that is missing preparation on existing queries as well as escaping on the user input passed to them. This makes it possible for unauthenticated a...
[en] The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
The User Activity Log plugin for WordPress is vulnerable to generic SQL Injection via the username value when logging in in versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ual_shook_wp_login_failed funct...
The User Activity Log plugin for WordPress is vulnerable to generic SQL Injection via the username value when logging in in versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ual_shook_wp_login_failed funct...
The User Activity Log plugin for WordPress is vulnerable to SQL Injection via several parameters like 'userrole', 'userip', 'username', and 'type' in versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ual_u...
The User Activity Log plugin for WordPress is vulnerable to generic SQL Injection via the ‘txtsearch’ parameter in versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta...
The User Activity Log plugin for WordPress is vulnerable to generic SQL Injection via the ‘txtsearch’ parameter in versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated atta...
The User Activity Log plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "$_SERVER['QUERY_STRING']" in versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
The User Activity Log plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘txtsearch’ parameter in versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
The User Activity Log plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "$_SERVER['QUERY_STRING']" in versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
The User Activity Log plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘txtsearch’ parameter in versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
There's no escaping done for $from_email and $to_email variables. Also, there's missing a nonce check. Update the plugin.
The plugin does not escape the txtsearch parameter before outputting it in an attribute, leading to a Reflected Cross-Site Scripting issue
The plugin does not escape the $_SERVER['QUERY_STRING'] before outputting it back in attributes, which could lead to Reflected Cross-Site Scripting in web browsers which do not encode URL characters.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free