CVE-2018-8729

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fbPatch, Third Party Advisory
https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9Patch, Release Notes, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/1836276Patch, Third Party Advisory
https://wordpress.org/plugins/aryo-activity-log/#developersRelease Notes, Third Party Advisory
https://www.exploit-db.com/exploits/44437/Exploit, Third Party Advisory, VDB Entry
https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fbPatch, Third Party Advisory
https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9Patch, Release Notes, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/1836276Patch, Third Party Advisory
https://wordpress.org/plugins/aryo-activity-log/#developersRelease Notes, Third Party Advisory
https://www.exploit-db.com/exploits/44437/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-87325.4Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_CVE-2018-87339.8Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated atta CVE-2018-87349.8SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrar CVE-2018-87358.8Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands CVE-2018-87368.8A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability esca CVE-2018-87375.4Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me" function. Within the Name and Note (aka cust CVE-2018-87386.1Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS.CVE-2018-87399.8VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper to CVE-2018-87407.5In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, rela CVE-2018-87418.8A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the host CVE-2018-87535.9The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attacke CVE-2018-87545.5The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-boun