CVE-2025-0924: WP Activity Log XSS Vulnerability

CVE-2025-0924 Overview

CVE-2025-0924 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Activity Log plugin for WordPress, developed by Melapress. The flaw exists in all versions up to and including 5.2.2 and stems from insufficient input sanitization and output escaping on the message parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when any user accesses an affected page. The vulnerability is tracked under [CWE-79] and affects logging functionality inside class-alert-manager.php and class-alert.php.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into activity log entries, executing arbitrary scripts in the browsers of administrators and other authenticated users viewing the log.

Affected Products

Melapress WP Activity Log plugin for WordPress versions ≤ 5.2.2
WordPress sites using the wp-security-audit-log plugin
All plugin deployments prior to the patched changeset 3238760

Discovery Timeline

2025-02-17 - CVE-2025-0924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0924

Vulnerability Analysis

The vulnerability resides in how the WP Activity Log plugin processes the message parameter before storing and rendering log entries. The plugin fails to sanitize input on the server side and does not escape output when rendering log messages back to administrative users. Because activity logs are typically viewed by privileged users, a stored payload executes within an authenticated administrator session, enabling session hijacking, administrative action forgery, and potential account takeover.

The injection point is reachable without authentication, which broadens the attack surface. Any action that generates a log entry containing attacker-controlled data can carry a payload. When an administrator later opens the activity log dashboard, the browser renders the malicious markup within the plugin's UI context. Exploitation requires user interaction — specifically a privileged user viewing the affected page — but no additional credentials or privileges on the target site.

Root Cause

The root cause is a combination of missing input sanitization at the point where log data is written and missing output escaping in the alert rendering routines exposed through classes/Controllers/class-alert-manager.php and classes/Controllers/class-alert.php. Values placed into the message parameter are stored as-is and later concatenated into HTML output without applying WordPress escaping functions such as esc_html() or wp_kses().

Attack Vector

An attacker sends a crafted request that triggers a log event with the message field containing HTML or JavaScript. The payload persists in the activity log database. When an administrator opens the log, the injected script executes in their browser session. Refer to the Wordfence Vulnerability Analysis and the WordPress Security Alert Manager source for the affected code paths.

Detection Methods for CVE-2025-0924

Indicators of Compromise

Activity log entries containing HTML tags such as <script>, <img onerror=, or <svg onload= in the message field
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains after opening the WP Activity Log dashboard
New administrative users, modified user roles, or altered plugin settings following log access by a privileged account
Requests to plugin endpoints originating from unauthenticated sources that generate log events with unusual payload sizes

Detection Strategies

Inspect the wp_wsal_* database tables for stored message values containing HTML or JavaScript syntax
Review web server access logs for anomalous requests targeting endpoints handled by the WP Activity Log plugin
Correlate administrator session activity with concurrent unusual API calls indicating hijacked sessions
Deploy a Web Application Firewall rule that blocks payloads matching common XSS signatures in requests reaching the plugin

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/wp-security-audit-log/ directory to detect tampering
Alert on plugin version strings below 5.2.3 across managed WordPress inventories
Monitor administrator account changes, new role assignments, and modified wp_options values as post-exploitation signals

How to Mitigate CVE-2025-0924

Immediate Actions Required

Update WP Activity Log to a version above 5.2.2 that includes the fix from WordPress Plugin Changeset #3238760
Audit existing activity log entries for stored payloads and purge any records containing HTML or script content
Rotate credentials and session tokens for administrators who accessed the activity log dashboard during the exposure window
Review recent administrative changes for signs of unauthorized modification

Patch Information

Melapress addressed the vulnerability in the plugin trunk via changeset 3238760. The fix introduces proper input sanitization on the message parameter and applies output escaping when rendering alerts. Site operators should install the latest release from the official WordPress plugin repository. See the WordPress Developer Resources for release details.

Workarounds

Restrict access to the WordPress admin area via IP allowlisting until the plugin is updated
Deploy a WAF rule blocking requests containing <script>, javascript:, or event-handler attributes destined for plugin endpoints
Temporarily deactivate the WP Activity Log plugin if patching cannot be performed immediately
Enforce Content Security Policy headers that disallow inline script execution on /wp-admin/ routes

bash

# Configuration example: update WP Activity Log via WP-CLI
wp plugin update wp-security-audit-log
wp plugin get wp-security-audit-log --field=version