User Activity Log < 1.4.7 – Reflected Cross Site Scripting via Query String | Plugin Vulnerabilities

Description

The plugin does not escape the $_SERVER['QUERY_STRING'] before outputting it back in attributes, which could lead to Reflected Cross-Site Scripting in web browsers which do not encode URL characters.

Proof of Concept

With a web browser which does not encode characters (or use burp suite and decode the URL via the repeater)

https://example.com/wp-admin/admin.php?page=user_action_log&paged=1&userrole=Administrator"><script>alert(/XSS/)</script>&username=&type=&txtsearch=

Affects Plugins

user-activity-log

Fixed in 1.4.7

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

swapnil subhash bodekar

Submitter

swapnil subhash bodekar

Verified

Yes

WPVDB ID

accf5522-cb5d-434b-98da-657e9ba8221e

Timeline

Publicly Published

2021-08-30 (about 4 years ago)

Added

2021-08-30 (about 4 years ago)

Last Updated

2021-08-30 (about 4 years ago)

Other

Published

Title

Published

2025-03-20

Title

Zalo Live Chat <= 1.1.0 - Reflected Cross-Site Scripting

Published

2021-08-09

Title

AddToAny < 1.7.46 - Admin+ Stored XSS

Published

2024-07-11

Title

Zoho CRM Lead Magnet < 1.7.8.9 - Reflected Cross-Site Scripting

Published

2025-08-30

Title

Institutions Directory < 1.3.4 - Reflected Cross-Site Scripting

Published

2026-01-06

Title

Easy GitHub Gist Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute