CVE-2023-4150

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	User Activity Tracking and Log	< 4.0.9

References

https://wpscan.com/vulnerability/381ef15b-aafe-4ef4-a0bc-867d891f7f44Exploit, Third Party Advisory
https://wpscan.com/vulnerability/381ef15b-aafe-4ef4-a0bc-867d891f7f44Exploit, Third Party Advisory

Timeline

Published: Aug 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-415039.8Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.CVE-2023-415048.8SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.CVE-2023-415059.8An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to e CVE-2023-415069.8An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attack CVE-2023-415079.8Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, di CVE-2023-415089.8A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.CVE-2023-41516.1The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response CVE-2023-415196.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter a CVE-2023-41527.5Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the CVE-2023-415208.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the clas CVE-2023-415218.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id CVE-2023-415228.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, f