CVE-2024-0868

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	coreActivity: Activity Logging plugin for WordPress	< 2.1
dev4press	coreactivity	< 2.1

References

https://wpscan.com/vulnerability/bb7c2d2b-cdfe-433b-96cf-714e71d12b22/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/bb7c2d2b-cdfe-433b-96cf-714e71d12b22/Exploit, Third Party Advisory

Timeline

Published: Apr 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-08696.5The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized CVE-2024-08705.3The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on CVE-2024-08715.4The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link CVE-2024-08724.3The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-CVE-2024-08735.4The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all version CVE-2024-08745.3A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.CVE-2024-08754.8A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into th CVE-2024-08794.3Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not CVE-2024-08808.8A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic. Affected by this issue is some unknown functionality of CVE-2024-08815.4The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper CVE-2024-08827.5A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /li CVE-2024-08839.8A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerabili