CVE-2024-10788: Pojo Activity Log XSS Vulnerability

CVE-2024-10788 Overview

CVE-2024-10788 is a Stored Cross-Site Scripting (XSS) vulnerability in the Activity Log – Monitor & Record User Changes plugin for WordPress. The flaw affects all versions up to and including 2.11.1. Unauthenticated attackers can inject arbitrary web scripts through event parameters that the plugin logs without proper sanitization. The malicious payload executes when an administrative user views the activity log page. The vulnerability is tracked under CWE-79 and stems from insufficient input sanitization and output escaping in plugin hook handlers.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in the browser of any administrator who views the affected log entries, enabling session hijacking, administrative account takeover, and persistent backdoors.

Affected Products

Pojo Activity Log plugin for WordPress, all versions through 2.11.1
WordPress sites using the aryo-activity-log plugin
Administrative dashboards rendering plugin-recorded event data

Discovery Timeline

2024-11-21 - CVE-2024-10788 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2024-10788

Vulnerability Analysis

The vulnerability resides in the Activity Log plugin's theme-related event hooks, specifically within class-aal-hook-themes.php. The plugin captures event parameters tied to theme actions and stores them in the database for administrative review. The capture path fails to sanitize incoming values and the rendering path fails to escape output before injecting data into the admin interface.

Because the affected hooks trigger from contexts reachable without authentication, an attacker can supply attacker-controlled values that persist in the activity log. When an administrator later opens the log view, the browser parses the stored payload as HTML and executes embedded JavaScript in the administrative session context.

The scope-changed nature of the issue means the injected script runs within the WordPress admin origin, granting access to nonces, session cookies, and privileged REST endpoints. Attackers can leverage the foothold to create new administrator accounts, install malicious plugins, or pivot to the underlying server.

Root Cause

The root cause is the absence of input sanitization functions such as sanitize_text_field() on stored event parameters, combined with missing output escaping via esc_html() or esc_attr() when rendering log entries. See the affected source in the WordPress Plugin Hook Resource.

Attack Vector

The attack is network-reachable and requires no authentication or privileges. An attacker triggers the vulnerable hook with a crafted parameter containing a script payload. The payload persists in the database and executes when an administrator accesses the activity log view. Refer to the Wordfence Vulnerability Analysis for additional exploitation context.

Detection Methods for CVE-2024-10788

Indicators of Compromise

Activity log entries containing <script>, onerror=, onload=, or javascript: strings in event parameter fields
Unexpected administrator account creation events shortly after suspicious log entries appear
Outbound requests from administrator browsers to unknown domains immediately after viewing the activity log
New or modified plugin installations not initiated by legitimate administrators

Detection Strategies

Query the wp_aal_activity_log table for rows whose serialized event parameters contain HTML control characters such as <, >, or quote-escaped script handlers
Monitor WordPress admin sessions for anomalous REST API activity originating immediately after wp-admin/admin.php?page=activity-log page loads
Inspect web server access logs for unauthenticated requests carrying script payload patterns in query parameters or POST bodies

Monitoring Recommendations

Enable a web application firewall with rules that block script tags and event handler attributes in request parameters
Log and review all administrator-initiated actions, focusing on user creation, role changes, and plugin installations
Alert on modifications to core WordPress files and the wp-content/plugins directory outside of approved maintenance windows

How to Mitigate CVE-2024-10788

Immediate Actions Required

Update the Activity Log plugin to a version newer than 2.11.1 as soon as a patched release is available
Audit the activity log database table for stored script payloads and purge any malicious entries
Rotate administrator credentials and invalidate active sessions if exploitation is suspected
Review the WordPress user list for unauthorized administrator accounts created since the plugin was first deployed

Patch Information

No vendor advisory URL is referenced in the NVD entry. Site operators should monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Analysis for confirmation of a fixed release version.

Workarounds

Deactivate and remove the Activity Log plugin until a patched version is installed
Deploy WAF rules that strip or block HTML and JavaScript payloads in parameters reaching wp-admin and front-end theme endpoints
Restrict access to the WordPress admin area via IP allowlisting to reduce administrator exposure to stored payloads
Apply Content Security Policy headers in the admin context to limit inline script execution

bash

# Example: disable the plugin via WP-CLI pending a patched release
wp plugin deactivate aryo-activity-log
wp plugin delete aryo-activity-log

# Example: search the activity log table for suspicious payloads
wp db query "SELECT hist_id, action, object_name FROM wp_aal_activity_log \
  WHERE object_name LIKE '%<script%' OR object_name LIKE '%onerror=%';"