7.5
High
CVE-2023-4279 This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers,…
Description
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| User Activity Log 1.6 | earliest → < 1.6.7 | 1.6.7 |
Other CVEs of User Activity Log
The 5 CVEs of User Activity Log →
CVE-2025-13471
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases,…
5.3
Medium
CVE-2023-4269
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs,…
4.3
Medium
CVE-2023-3435
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before…
Not rated
CVE-2023-2761
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter…
Not rated