CVE-2024-10793: high-severity vulnerability in melapress WP Activity Log
WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 1.5%
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
melapress · WP Activity LogRelated CVEs — melapress WP Activity Log
In the same product, most dangerous first.
CVE-2025-0924HIGHWP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.4%CVE-2020-36716HIGHWP Activity Log <= 4.0.1 - Missing AuthorizationEPSS 0.8%CVE-2023-2261MEDIUMWP Activity Log <= 4.5.0 - Missing Capabilities Check to User EnumerationEPSS 0.6%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2023-2286MEDIUMWP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanupEPSS 0.3%CVE-2026-120075HIGHWP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.2%