Not rated
CVE-2023-2761 The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter…
Description
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| User Activity Log 1.6 | earliest → < 1.6.3 | 1.6.3 |
Other CVEs of User Activity Log
The 5 CVEs of User Activity Log →
CVE-2025-13471
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases,…
5.3
Medium
CVE-2023-4279
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers,…
7.5
High
CVE-2023-4269
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs,…
4.3
Medium
CVE-2023-3435
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before…
Not rated