CVE-2024-10788 in Activity Log Plugin
Summary
by MITRE • 11/21/2024
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/09/2025
The vulnerability identified as CVE-2024-10788 affects the Activity Log – Monitor & Record User Changes plugin for WordPress, a widely used tool for tracking user activities and system changes within WordPress environments. This plugin serves as a critical security monitoring component for administrators who need to track user actions, plugin modifications, and other system events. The vulnerability exists in all versions up to and including 2.11.1, making it a significant concern for WordPress installations that rely on this monitoring functionality. The flaw represents a serious security weakness that could allow attackers to compromise administrator sessions and potentially gain full control over affected WordPress sites.
The technical root cause of this vulnerability stems from insufficient input sanitization and output escaping mechanisms within the plugin's handling of event parameters. When the plugin processes user activity events, it fails to properly sanitize the input data before storing it in the database or rendering it in administrative interfaces. This allows malicious actors to inject malicious JavaScript code through the event parameter fields, which are then stored and executed whenever administrative users view the activity logs. The vulnerability specifically affects the plugin's ability to properly escape output when displaying event data, creating a classic stored cross-site scripting scenario where the malicious payload persists and executes in the context of the victim's browser.
The operational impact of this vulnerability is severe and far-reaching for WordPress administrators and security teams. Unauthenticated attackers can exploit this weakness to inject arbitrary web scripts that will execute whenever an administrative user accesses the affected pages. This creates a persistent threat vector where attackers can perform actions such as stealing administrator session cookies, redirecting users to malicious sites, defacing content, or even executing additional malicious payloads. The vulnerability undermines the integrity of the administrative interface and compromises the security monitoring capabilities that the plugin was designed to provide. Attackers can leverage this to maintain persistent access, escalate privileges, or conduct further reconnaissance within the compromised WordPress environment.
This vulnerability maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation, which is a fundamental weakness in web application security that allows malicious input to be executed as part of web content. The issue also aligns with ATT&CK technique T1566.001: Phishing, as attackers can use this vulnerability to create malicious pages that appear legitimate to administrators. Additionally, the vulnerability relates to ATT&CK technique T1059.007: Command and Scripting Interpreter: JavaScript, which describes how attackers can execute malicious JavaScript code through web browsers. The Stored XSS nature of this vulnerability makes it particularly dangerous as it can persist for extended periods and affect multiple administrators who view the activity logs. Organizations should immediately update to the latest version of the plugin, implement proper input validation measures, and monitor for signs of exploitation. Security teams should also consider implementing network-based protections and browser security controls to mitigate the risk of exploitation, while administrators should review their activity logs for any signs of malicious injection attempts.