Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-10891: WordPress aryo-activity-log plugin lets attackers inject scripts

CVE-2016-10891 · published 7 years ago

Summary

The aryo-activity-log plugin for WordPress versions earlier than 2.3.3 can be tricked into running malicious code in a web browser. This could allow an attacker to steal information or perform actions as the logged‑in user. Install the plugin version 2.3.3 or newer as soon as possible to close the risk.

What to do

Update pojo activity_log to version 2.3.3 or later.

Affected software

Vendor	Product	Affected versions
pojo	activity_log	< 2.3.3 `cpe:2.3:a:pojo:activity_log::::::wordpress::*`

Original advisory text

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.

References

https://wordpress.org/plugins/aryo-activity-log/#developers Release Notes

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published21 Aug 2019

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2016-10891 · NVD

Track software like this

Free during beta