CVE-2018-8729

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-8729. PoCs published by Stefan Broeder.

AI-analyzed exploit summary This is a detailed writeup describing a stored XSS vulnerability in the Activity Log WordPress plugin (version 2.4.0). The vulnerability arises from unsanitized output of post titles in log entries, allowing arbitrary JavaScript execution when viewed.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

Exploits (2)

exploitdb WRITEUP

by Stefan Broeder · textwebappsphp

https://www.exploit-db.com/exploits/44437

View Code ZIP pw:eip

This is a detailed writeup describing a stored XSS vulnerability in the Activity Log WordPress plugin (version 2.4.0). The vulnerability arises from unsanitized output of post titles in log entries, allowing arbitrary JavaScript execution when viewed.

Classification

Writeup 100%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Aryo Activity Log WordPress Plugin 2.4.0

Auth required

Prerequisites: WordPress user role with post/comment/attachment creation privileges

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →