CVE-2024-10793

Deeper analysis

The WP Activity Log plugin for WordPress is vulnerable to stored cross-site scripting via the user_id parameter in all versions up to and including 5.2.1. The flaw is caused by insufficient input sanitization and output escaping, tracked as CWE-79 with a CVSS 3.1 score of 7.2 reflecting network attack vector, low complexity, no required privileges or user interaction, and changed scope.

Unauthenticated attackers can exploit the issue to inject arbitrary web scripts that execute in the context of an administrative user who later accesses an affected page, resulting in limited confidentiality and integrity impacts.

The provided references point to the Wordfence threat intelligence entry and the plugin source file class-wp-system-sensor.php without describing specific patches or mitigation steps. The EPSS score sits at 0.6871 with no material rise from a lower baseline.