CVE-2024-10793: WP Activity Log XSS Vulnerability

CVE-2024-10793 Overview

CVE-2024-10793 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Activity Log plugin for WordPress. The flaw affects all versions up to and including 5.2.1 and stems from insufficient input sanitization and output escaping on the user_id parameter [CWE-79]. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any administrative user who views an affected page.

Critical Impact
Unauthenticated attackers can persist JavaScript payloads that execute in the administrator's browser session, enabling account takeover, session theft, and further WordPress compromise.

Affected Products

Melapress WP Activity Log for WordPress — all versions through 5.2.1
Free and Premium editions distributed via the WordPress plugin repository
WordPress sites where the plugin logs user or system events referencing the user_id parameter

Discovery Timeline

2024-11-15 - CVE-2024-10793 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-10793

Vulnerability Analysis

WP Activity Log records events across the WordPress environment, including user and system activity. The affected code path in classes/WPSensors/class-wp-system-sensor.php consumes the user_id parameter and stores it as part of an activity log entry without applying sufficient sanitization. When an administrator later reviews the activity log, the stored value is rendered in the admin interface without adequate output escaping, allowing embedded HTML and JavaScript to execute.

Because the injection is stored, a single request seeds a payload that fires on every subsequent view by a privileged user. The scope change reflects the payload executing in the administrator context after being submitted by an unauthenticated actor. See the WordPress Security Audit Log Class source for the affected function.

Root Cause

The plugin fails to sanitize input received in the user_id parameter and does not escape the value when it is later emitted into administrative pages. The parameter is treated as trusted numeric data despite being reachable by unauthenticated requests. The combination of missing sanitization on write and missing escaping on read produces a persistent XSS sink [CWE-79].

Attack Vector

An unauthenticated attacker submits a crafted request containing an XSS payload in the user_id parameter. The plugin persists the value in the activity log. When an administrator opens the log view, the payload executes with the administrator's privileges. Exploitation requires that a privileged user subsequently view the injected entry, which is a routine operational activity for site administrators. See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2024-10793

Indicators of Compromise

Requests containing HTML tags, JavaScript keywords, or event handlers (<script, onerror=, onload=) in the user_id parameter
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains after viewing the WP Activity Log dashboard
New WordPress administrator accounts, modified user roles, or plugin installations that follow an admin login without matching legitimate workflow
Activity log entries where user_id contains non-numeric characters

Detection Strategies

Inspect the wp_wsal_* database tables for stored entries whose user_id field deviates from expected integer values
Enable web application firewall rules that block script tags and JavaScript event handlers in query and body parameters targeting WordPress endpoints
Correlate unauthenticated POST requests to plugin endpoints with subsequent administrator sessions that trigger anomalous outbound traffic
Review WordPress access logs for repeated probing of activity log endpoints from single source IPs

Monitoring Recommendations

Alert on browser-originated requests from admin sessions to unknown external hosts
Monitor for creation of administrator accounts and privilege changes on WordPress installations running vulnerable plugin versions
Track plugin version inventory across all managed WordPress sites and flag installations at or below 5.2.1

How to Mitigate CVE-2024-10793

Immediate Actions Required

Update WP Activity Log to a version newer than 5.2.1 on all WordPress installations
Audit existing activity log entries and purge records containing script content in the user_id field
Rotate administrator credentials and invalidate active sessions on sites where exploitation is suspected
Review recent administrative changes for unauthorized account creation or configuration modification

Patch Information

Melapress addressed the vulnerability in a release following 5.2.1. Site administrators should upgrade through the WordPress plugin update interface or by installing the latest package from the plugin repository. Confirm the installed version reports higher than 5.2.1 after the update completes.

Workarounds

Deploy a WordPress-aware WAF ruleset that blocks XSS payloads in request parameters submitted to plugin endpoints
Restrict access to /wp-admin/ and plugin AJAX endpoints by source IP where operationally feasible
Temporarily deactivate the WP Activity Log plugin if immediate patching is not possible and the activity log is not actively monitored
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution

bash

# Confirm installed WP Activity Log version via WP-CLI
wp plugin get wp-security-audit-log --field=version

# Update the plugin to the latest patched release
wp plugin update wp-security-audit-log

# Temporary deactivation if patching is delayed
wp plugin deactivate wp-security-audit-log