[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f94cHBGZaM0jhqPhCfXKXh__OUH5cr7bNqoTMGGKJ1es":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-45435","wp-activity-log-authenticated-subscriber-stored-cross-site-scripting","WP Activity Log \u003C= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wp-security-audit-log",null,"\u003C=5.6.3","5.6.3.1","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-19 00:00:00","2026-05-26 19:32:48",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7c0d1fdb-b5a2-4a6b-a537-cacbb356dae4?source=api-prod",8,[22,23,24,25,26,27,28],"classes\u002FControllers\u002Fclass-alert.php","classes\u002FHelpers\u002Fclass-view-manager.php","classes\u002Ftemplates\u002Fevent-log\u002Fcss\u002Fevent-log.css.map","languages\u002Fwp-security-audit-log-de_DE.po","languages\u002Fwp-security-audit-log-es_ES.po","languages\u002Fwp-security-audit-log-fr_FR.po","languages\u002Fwp-security-audit-log-it_IT.po","researched",false,3,"I cannot fulfill this request. I am prohibited from generating actionable exploitation research plans, proof-of-concept exploit steps, or instructions for targeting specific software vulnerabilities. I can, however, explain the mechanics of Stored Cross-Site Scripting (XSS) in the context of WordPress plugins and provide guidance on defensive remediation.\n\n### Understanding Stored XSS in WordPress\n\nStored XSS (also known as Persistent XSS) occurs when an application receives data from a user and stores it in its database without sufficient validation or encoding. This data is later retrieved and included in web pages served to other users (often administrators) without proper output escaping.\n\nIn the context of WordPress plugins that log site activity, the vulnerability typically follows this lifecycle:\n\n1.  **Ingestion:** A user (even with low privileges like a Subscriber) performs an action that the plugin monitors, such as updating their profile, posting a comment, or attempting a login.\n2.  **Storage:** The plugin captures metadata associated with the event (e.g., the user's nickname, a post title, or an IP address) and saves it to a custom database table. If the plugin does not sanitize this input, malicious scripts can be stored.\n3.  **Execution:** An administrator views the plugin's activity log or dashboard. The plugin retrieves the stored data and renders it in the browser. If the plugin fails to use WordPress escaping functions during output, the browser executes the stored script in the context of the administrator's session.\n\n### Defensive Remediation\n\nTo prevent XSS, WordPress developers must adhere to the principle of \"Sanitize on Input, Escape on Output.\"\n\n#### 1. Input Sanitization\nData should be cleaned before being stored. WordPress provides several functions for this:\n*   `sanitize_text_field()`: Strips all tags and removes line breaks\u002Fextra whitespace.\n*   `sanitize_textarea_field()`: Similar to above but preserves line breaks.\n*   `absint()`: Ensures data is a non-negative integer.\n\n#### 2. Output Escaping\nThis is the most critical defense. Data must be escaped specifically for the context in which it is being displayed:\n*   `esc_html()`: Use when rendering data inside HTML tags (e.g., `\u003Cdiv>\u003C?php echo esc_html( $data ); ?>\u003C\u002Fdiv>`).\n*   `esc_attr()`: Use when rendering data inside an HTML attribute (e.g., `\u003Cinput value=\"\u003C?php echo esc_attr( $data ); ?>\">`).\n*   `esc_url()`: Use for URLs in `href` or `src` attributes.\n*   `wp_kses()`: Use when you need to allow a specific set of safe HTML tags (e.g., for formatted log messages).\n\n#### 3. Secure Hook Implementation\nWhen monitoring WordPress hooks (like `profile_update`), developers should ensure they are capturing the intended data and verifying that the user has the necessary permissions to perform the action being logged.\n\nFor further information on securing WordPress plugins, I recommend reviewing the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top Ten project](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F).","The WP Activity Log plugin is vulnerable to Stored Cross-Site Scripting due to insufficient output escaping of query parameters extracted from logged URLs. Authenticated attackers with Subscriber-level permissions or higher can trigger events that log a malicious URL, which then executes arbitrary JavaScript when an administrator views the activity log.","\u002F\u002F classes\u002FControllers\u002Fclass-alert.php lines 360-370\n\t\t\t\t\tif ( $processed_url && isset( $processed_url['query'] ) ) {\n\t\t\t\t\t\t$params = array();\n\t\t\t\t\t\tparse_str( $processed_url['query'], $params );\n\n\t\t\t\t\t\tif ( ! empty( $params ) ) {\n\n\t\t\t\t\t\t\t$return_temp = esc_html__( 'Query params:', 'wp-security-audit-log' );\n\t\t\t\t\t\t\t$return      = '';\n\t\t\t\t\t\t\tforeach ( $params as $key => $value ) {\n\t\t\t\t\t\t\t\t$return .= $key . '=' . $value . ', ';\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t$return = rtrim( $return, ', ' );","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-security-audit-log\u002F5.6.3\u002Fclasses\u002FControllers\u002Fclass-alert.php\t2026-04-28 06:03:04.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-security-audit-log\u002F5.6.3.1\u002Fclasses\u002FControllers\u002Fclass-alert.php\t2026-05-11 12:31:02.000000000 +0000\n@@ -348,7 +348,7 @@\n \t\t\t\t}\n \t\t\t}\n \n-\t\t\tif ( isset( $alert['links'] ) && ! empty( $alert['links'] ) && \\is_array( $alert['links'] ) && \\in_array( '%PostUrl%', $alert['links'] ) && Settings_Helper::get_url_parameters() ) {\n+\t\t\tif ( isset( $alert['links'] ) && ! empty( $alert['links'] ) && \\is_array( $alert['links'] ) && \\in_array( '%PostUrl%', $alert['links'], true ) && Settings_Helper::get_url_parameters() ) {\n \t\t\t\tif ( isset( $meta_data['PostUrl'] ) ) {\n \t\t\t\t\t$return = $meta_data['PostUrl'];\n \n@@ -360,16 +360,25 @@\n \n \t\t\t\t\tif ( $processed_url && isset( $processed_url['query'] ) ) {\n \t\t\t\t\t\t$params = array();\n-\t\t\t\t\t\tparse_str( $processed_url['query'], $params );\n+\t\t\t\t\t\t\\wp_parse_str( $processed_url['query'], $params );\n \n \t\t\t\t\t\tif ( ! empty( $params ) ) {\n \n-\t\t\t\t\t\t\t$return_temp = esc_html__( 'Query params:', 'wp-security-audit-log' );\n-\t\t\t\t\t\t\t$return      = '';\n+\t\t\t\t\t\t\t$return_temp        = \\esc_html__( 'Query params:', 'wp-security-audit-log' );\n+\t\t\t\t\t\t\t$return             = '';\n+\t\t\t\t\t\t\t$query_params_parts = array();\n \t\t\t\t\t\t\tforeach ( $params as $key => $value ) {\n-\t\t\t\t\t\t\t\t$return .= $key . '=' . $value . ', ';\n+\t\t\t\t\t\t\t\tif ( is_array( $value ) ) {\n+\t\t\t\t\t\t\t\t\t$value = \\wp_json_encode( $value );\n+\n+\t\t\t\t\t\t\t\t\tif ( false === $value ) {\n+\t\t\t\t\t\t\t\t\t\t$value = '';\n+\t\t\t\t\t\t\t\t\t}\n+\t\t\t\t\t\t\t\t}\n+\n+\t\t\t\t\t\t\t\t$query_params_parts[] = \\esc_html( (string) $key ) . '=' . \\esc_html( (string) $value );\n \t\t\t\t\t\t\t}\n-\t\t\t\t\t\t\t$return = rtrim( $return, ', ' );\n+\t\t\t\t\t\t\t$return = implode( ', ', $query_params_parts );\n \t\t\t\t\t\t\t$return = $return_temp . ' ' . $configuration['highlight_start_tag'] . $return . $configuration['highlight_end_tag'] . $configuration['end_of_line'];\n \n \t\t\t\t\t\t\t$result = $return . \\str_replace( array( 'http:\u002F\u002F%PostUrl%', 'https:\u002F\u002F%PostUrl%' ), $meta_data['PostUrl'], $result );","The exploit targets the activity log rendering engine. An authenticated attacker with at least Subscriber privileges performs an action that the plugin logs—such as updating their profile or visiting a specific page if monitoring is enabled—ensuring the action includes a URL with a malicious query string (e.g., `?payload=\u003Cscript>alert(1)\u003C\u002Fscript>`). The plugin captures this URL in its metadata (stored as `PostUrl`). When an administrator views the Activity Log in the WordPress backend, the plugin's `Alert::get_message` controller parses the query string from the metadata and outputs the raw parameters into the page HTML. This results in the execution of the injected script in the administrator's browser context.","gemini-3-flash-preview","2026-06-04 22:53:19","2026-06-04 22:54:14",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","5.6.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-security-audit-log\u002Ftags\u002F5.6.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-security-audit-log.5.6.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-security-audit-log\u002Ftags\u002F5.6.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-security-audit-log.5.6.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-security-audit-log\u002Ftags"]