Medium · 5.4 CVE-2023-5167 EUVD-2023-57504GHSA-p7q4-fcj5-j6x7

User Activity Log Pro < 2.3.4 - Unauthenticated Stored Cross-Site Scripting via User Agent

Published Oct 16, 2023 · Updated Apr 23, 2025 · Assigned by WPScan

Description

The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.

Affected products

Vendor	Product	Affected	Fixed
—	user-activity-log-pro	< 2.3.4	2.3.4

References

https://wpscan.com/vulnerability/78ea6fe0-5fac-4923-949c-023c85fe2437 exploit vdb-entry technical-description