WordPress Plugin CoreActivity Activity Logging Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the WordPress plugin CoreActivity: Activity Logging, affecting versions prior to 1.8.1. The issue arises because the plugin fails to properly escape certain request data before displaying it in the admin dashboard. This flaw allows unauthenticated users to inject malicious scripts that could be executed by users with high privileges, such as administrators.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user with high privileges.

Remediation

Users are advised to update the CoreActivity: Activity Logging plugin to version 1.8.1 or later.