CVE-2018-8729

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 5.4%

from disclosure to weapon21 days

Published on NVDMar 15

1st PoC+21d

exploitation probability

5.4%top 8% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/44437/unverified exploitdbwww.exploit-db.com/exploits/44409unverified exploitdbwww.exploit-db.com/exploits/44437unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/pojome/activity-log/commit/950c46b2290c991187ff3471640e9688b16908fb https://github.com/pojome/activity-log/commit/e7bcd12fcb0add82bed762a971f427a360664bd9 https://plugins.trac.wordpress.org/changeset/1836276 https://wordpress.org/plugins/aryo-activity-log/#developers https://www.exploit-db.com/exploits/44437/