coreActivity < 1.8.1 – Unauthenticated Stored XSS | CVE 2024-0852 | Plugin Vulnerabilities

Description

The plugin does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin

Proof of Concept

As unauthenticated: curl 'https://example.com/<script>alert(`XSS`)</script>'

The XSS will be triggered when an admin visit the logs dashboard: https://example.com/wp-admin/admin.php?page=coreactivity-logs

Affects Plugins

Fixed in 1.8.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

Ahmed Algohary

Verified

Yes

WPVDB ID

743c4d79-e1d5-4fb0-a17d-296df2c54e8a

Timeline

Publicly Published

2024-01-26 (about 1 year ago)

Added

2024-01-26 (about 1 year ago)

Last Updated

2024-01-26 (about 1 year ago)

Other

Published

Title

Published

2025-12-26

Title

AM Events <= 1.13.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2023-11-15

Title

Better RSS Widget <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-03

Title

EMC2 Alert Boxes <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-11-08

Title

PF Timer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-01-23

Title

WP Go Maps (formerly WP Google Maps) < 9.0.29 - Unauthenticated Reflected Cross-Site Scripting