WordPress Plugin Vulnerabilities

Activity Log < 2.7.0 - Authenticated SQL Injection

Description

The plugin was vulnerable to SQL Injection in the order column of the past events table.

Proof of Concept

Affects Plugins

Plugin icon
aryo-activity-log
Fixed in 2.7.0

References

URL
https://www.synacktiv.com/sites/default/files/2021-06/WP_AryoActivityLog_Vulnerability.pdf

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
6.5 (medium)

Miscellaneous

Verified
No
WPVDB ID
279972d3-6847-4d84-8532-01ff96f0aacc

Timeline

Publicly Published
2021-05-03 (about 4 years ago)
Added
2021-07-16 (about 4 years ago)
Last Updated
2021-07-30 (about 4 years ago)

Other

Published
Title
Published
2022-12-09
Title
Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi
Published
2025-11-12
Title
0 Day Analytics < 4.1.0 - Authenticated (Administrator+) SQL Injection
Published
2015-01-28
Title
Photo Gallery < 1.2.11 - Blind SQL Injection
Published
2014-08-01
Title
Beer Recipes 1.0 - XSS
Published
2025-05-19
Title
RSVPMarker < 11.5.7 - Authenticated (Contributor+) SQL Injection